4

I am writing a Cloudformation template to request an ACM certificate for the Cloudfront to have SSL via DNS

My template:

ACMCertificate: 
  Type: "AWS::CertificateManager::Certificate"
  Properties: 
    DomainName: mywebsite.com
    SubjectAlternativeNames:
      - www.mywebsite.com
    DomainValidationOptions:
          - DomainName: mywebsite.com
            HostedZoneId: !Ref MyHostedZoneId
          - DomainName: www.mywebsite.com
            HostedZoneId: !Ref MyHostedZoneId
    ValidationMethod: DNS

Outputs:
  ACMCertificateArn:
    Value: !Ref ACMCertificate

The issue: the certificate was created in the region of the AWS account, in my case it's eu-west-1. You know that this certificate can not be used for SSL, need to be created in us-east-1

How to specify the region in the Cloudformation template for validating the ACM certificate?

Any suggestion is appreciated.

franco phong
  • 2,219
  • 3
  • 26
  • 43

2 Answers2

2

You may be able to specify an AWS region to create the certificate in, specifice region is independent of the Cloudformation stack region which for example makes it possible to deploy a certificate in region us-east-1 (to use with cloudfront) while deploying the stack in region eu-west-1. By using custom resouce in cloudformaion

CreateCertificateCustomResource:
  Type: Custom::CreateCertificates
  Properties:
    ServiceToken: CreateCertificateFunction.Arn
    DomainName: yourdomain
    ValidationDomain: DomainName
    HostedZoneId: yourzoneid
    CertificateRegion: yourRegion
    IdempotencyToken: CreateCertificateCustomReource
    CertificateTafs:
      - Key: Name
        Value: DomainName
Asri Badlah
  • 1,949
  • 1
  • 9
  • 20
1

Sadly, you can't do this from within the template. You have to create your stack in us-east-1 "manually". This means that if you are using AWS Console for that, you have to change the region in the console, and create your stack in that region using CloudFormation console.

If you are using AWS CLI's create-stack command, you can add --region us-east-1 as one of its parameters. For AWS SDK, such as boto3 you can do analogical operation.

You can also look at StackSets which allow you to deploy your templates across multiple accounts and regions from one central location.

Marcin
  • 215,873
  • 14
  • 235
  • 294