验证来自 AWS Terraform 中 2 个不同账户的证书

Question

I have an individual(dev) account and the certificate is created based on the below module. The validation takes place in the root account (ie, prod account) so when I go to the route 53 of the root account and add the domain entries (create record) and copy the CVALUE of the domain and paste it over there, then my individual account certificate gets validated and changed from "Pending Validation" to "Issued".

I want the below tf to add the entries (domain name and CVALUE) to the root account so that while terraform apply the certificate gets validated. Right now, I am manually adding the CVALUE entries to the root account for validation.

public_dns.tf

resource "aws_route53_zone" "public" {
  name = var.domain
}

resource "aws_acm_certificate" "elb_cert" {
  domain_name = var.domain
  subject_alternative_names = ["*.${var.domain}"]
  validation_method = "DNS"
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.elb_cert.domain_validation_options : dvo.domain_name => {
      name = dvo.resource_record_name
      record = dvo.resource_record_value
      type = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name = each.value.name
  records = [each.value.record]
  ttl = 60
  type = each.value.type
  zone_id = aws_route53_zone.public.zone_id
}

resource "aws_acm_certificate_validation" "elb_cert" {
  count = var.certify_domain ? 1 : 0
  certificate_arn = aws_acm_certificate.elb_cert.arn
  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
}

Answer 1

To accomplish what you want, you will need to use multiple aws providers (alias). One for the root account and one for the dev account, as you will be managing resources in two different accounts.

it will look something like this:

provider "aws" {
  alias  = "prod"
  ***
}

provider "aws" {
  alias  = "dev"
  ***
}

resource "aws_******"{
  provider = aws.prod
  ***
  ***
}

resource "aws_******"{
  provider = aws.dev
  ***
  ***
}

Official documentation

Medium article about it