Skip to content

/ terraform-provider-aws

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Recreate ACM certificate if it has timed out #15099

Open
walkafwalka opened this issue Sep 10, 2020 · 2 comments
Open

Recreate ACM certificate if it has timed out #15099

walkafwalka opened this issue Sep 10, 2020 · 2 comments
Labels
enhancement good first issue service/acm

Comments

@walkafwalka
Copy link

@walkafwalka walkafwalka commented Sep 10, 2020

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

We create ACM certificates for clients who we do not have DNS zone control over. Sometimes they take to long to add the records, so we have to recreate the certificate since it expires after a certain amount of time. I am proposing a flag to force recreate the certificate if has timed out.

New or Affected Resource(s)

  • aws_acm_certificate

Potential Terraform Configuration

resource "aws_acm_certificate" "client" {
  domain_name               = var.domain_name
  subject_alternative_names = var.subject_alternative_names
  validation_method         = var.validation_method

  # Destroy and recreate ACM if `VALIDATION_TIMED_OUT` is in `statuses`.
  recreate_on_timeout = true

  lifecycle {
    create_before_destroy = true
  }
}
@hashibot hashibot bot added the service/acm label Sep 10, 2020
@bflad bflad removed the needs-triage label Sep 10, 2020
@bflad
Copy link
Contributor

@bflad bflad commented Sep 10, 2020

Given that certificates in the VALIDATION_TIMED_OUT status are not valid anyways, it might be best to just automatically trigger resource recreation without the extra argument. This can be done by adding the following to the resourceAwsAcmCertificateRead function before we begin calling the various d.Set():

if aws.StringValue(resp.Certificate.Status) == acm.CertificateStatusValidationTimedOut {
  log.Printf("[WARN] ACM Certificate (%s) is in status (%s), removing from state", d.Id(), aws.StringValue(resp.Certificate.Status))
  d.SetId("")
  return nil
}

(We could/should probably handle other status in there such as FAILED but that is outside the scope of this request 😄 )

Given the 72 hour timeout, we likely would not want to add a covering acceptance test. If you or anyone is interested in submitting the above, we can get this in. 👍
@gunadhya
Copy link

@gunadhya gunadhya commented Sep 11, 2020

Hi @bflad , I'd like to work on this issue.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement good first issue service/acm
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
@bflad @gunadhya @walkafwalka
You can’t perform that action at this time.