24

I am trying to use a certificate issued in eu-central-1 for my apigateway which is regional and works in the same region.

My terraform code is as follows:

//ACM Certificate

provider "aws" {
  region = "eu-central-1"
  alias = "eu-central-1"
}

resource "aws_acm_certificate" "certificate" {
  provider = "aws.eu-central-1"
  domain_name       = "*.kumite.xyz"
  validation_method = "EMAIL"
}

//Apigateway

resource "aws_api_gateway_rest_api" "kumite_writer_api" {
  name = "kumite_writer_api"
  endpoint_configuration {
    types = ["REGIONAL"]
  }
}

resource "aws_api_gateway_domain_name" "domain_name" {
  certificate_arn = aws_acm_certificate.certificate.arn
  domain_name     = "recorder.kumite.xyz"
  endpoint_configuration {
    types = ["REGIONAL"]
  }
}

Unfortunately, I constantly get this error:

Error: Error creating API Gateway Domain Name: BadRequestException: Cannot import certificates for EDGE while REGIONAL is active.

What I am missing here? I think my ApiGateway is not EDGE but REGIONAL so cannot find sense to the error...

Arcones
  • 3,954
  • 4
  • 26
  • 46

1 Answers1

43

Change certificate_arn to regional_certificate_arn.

From documentation (emphasis mine):

When referencing an AWS-managed certificate, the following arguments are supported:

  • certificate_arn - (Optional) The ARN for an AWS-managed certificate. AWS Certificate Manager is the only supported source. Used when an edge-optimized domain name is desired. Conflicts with certificate_name, certificate_body, certificate_chain, certificate_private_key, regional_certificate_arn, and regional_certificate_name.
  • regional_certificate_arn - (Optional) The ARN for an AWS-managed certificate. AWS Certificate Manager is the only supported source. Used when a regional domain name is desired. Conflicts with certificate_arn, certificate_name, certificate_body, certificate_chain, and certificate_private_key.
kgadek
  • 1,446
  • 1
  • 17
  • 18
  • 1
    hey @kgadek. Thanks for the answer! Can you also link the documentation? – json singh Sep 20 '20 at 07:18
  • Added. For reference: currently aws provider version 3.7.0, terraform version 0.13.3. – kgadek Sep 21 '20 at 08:07
  • 1
    It's the same for CloudFormation too: CertificateArn -> RegionalCertificateArn https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-domainname.html – helloPiers Aug 12 '22 at 12:52