AWS CloudFormation：编写一个 Lambda 函数来验证 ACM 证书的域所有权

Question

I am creating an ACM Cert in CloudFormation. Based on this documentation , AWS sends out an email to the addresses registered in WHOIS.

The docs for CloudFormation say:

Important

When you use the AWS::CertificateManager::Certificate resource in an AWS CloudFormation stack, the stack will remain in the CREATE_IN_PROGRESS state and any further stack operations will be delayed until you act upon the instructions in the certificate validation email.

Usually for similar things, like creating and accepting a VPC peering connection in multiple accounts , or enabling SNS Topic subscriptions that are created in CFN, I write a lambda function as a Custom Resource to handle that.

What would be the API calls needed to verify domain ownership? Can this even be done in a Lambda function?

Chances are the emails will go to the IT Manager, but it would be nice to have that automated.

Answer 1

There is no API call to verify domain ownership as this need to verified with Email on your whois records.

You can also automate it this way. Change the technical contact email address of whois records to an ses domain email address.

SES Email --> S3 Bucket (Trigger) --> Lambda (Confirm with the link in the content of email).

You need to revert your email address back to your inbox, incase of any email need to be delivered for Technical contact relating to your domain or subdomain.

Documentation on domain verification:

http://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate.html

Thx !

Answer 2

This repo aws-cfn-acm contains a CloudFormation template including a Lambda function that works in a similar way to your requirements.

The Lambda function automates the certificate validation by the DNS method, not the EMAIL method you are using. It requires the domain name related to the certificate must be hosted in name.com . name.com provides an API service that the Lambda functions can leverage on. It should be easy to extend to support other DNS service providers.

The template is using the inline Lambda function, the code is not easy to read, here's a well-formatted version of the Lambda function.