Terraform 無法創建與雲端的“aws_acm_ceritificate”鏈接

Question

我使用aws_acm_ceritifcate資源配置了以下證書：

provider "aws" {
  alias  = "virginia"
  region = "us-east-1"
}

resource "aws_acm_certificate" "primary" {
  domain_name               = var.domain_name
  validation_method         = "DNS"
  subject_alternative_names = ["*.${var.domain_name}"]
  provider                  = aws.virginia

  lifecycle {
    create_before_destroy = true
  }

  tags = merge(
    var.tags,
    {
      Name = "${var.project}-ACM-certificate",
    }
  )
}

resource "aws_route53_record" "certificate_validator_record" {
  allow_overwrite = true
  name            = tolist(aws_acm_certificate.primary.domain_validation_options)[0].resource_record_name
  records         = [tolist(aws_acm_certificate.primary.domain_validation_options)[0].resource_record_value]
  type            = tolist(aws_acm_certificate.primary.domain_validation_options)[0].resource_record_type
  zone_id         = aws_route53_zone.primary.zone_id
  ttl             = 60
}

resource "aws_acm_certificate_validation" "certificate_validator" {
  certificate_arn         = aws_acm_certificate.primary.arn
  validation_record_fqdns = [aws_route53_record.certificate_validator_record.fqdn]
}

如您所見，我需要證書來驗證配置的域及其子域。 我配置了 Cloudfront：

module "cdn" {
  source                        = "terraform-aws-modules/cloudfront/aws"
  comment                       = "CloudFront for caching S3 private and static website"
  is_ipv6_enabled               = true
  price_class                   = "PriceClass_100"
  create_origin_access_identity = true
  aliases                       = [var.frontend_domain_name]

  origin_access_identities = {
    s3_identity = "S3 dedicated for hosting the frontend"
  }

  origin = {
    s3_identity = {
      domain_name = module.s3_bucket.s3_bucket_bucket_regional_domain_name
      s3_origin_config = {
        origin_access_identity = "s3_identity"
      }
    }
  }

  default_cache_behavior = {
    target_origin_id       = "s3_identity"
    viewer_protocol_policy = "redirect-to-https"
    default_ttl            = 5400
    min_ttl                = 3600
    max_ttl                = 7200
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true
    query_string           = true
  }

  default_root_object = "index.html"

  custom_error_response = [
    {
      error_code         = 403
      response_code      = 404
      response_page_path = "/index.html"
    },
    {
      error_code         = 404
      response_code      = 404
      response_page_path = "/index.html"
    }
  ]

  viewer_certificate = {
    acm_certificate_arn = aws_acm_certificate.primary.arn
    ssl_support_method  = "sni-only"
  }

  tags = merge(
    var.tags,
    {
      Name  = "${var.project}-Cloudfront",
      Stack = "frontend"
    }
  )
}

但是當我嘗試創建這個 terraform 計划時，我得到了這個錯誤：

module.cdn.aws_cloudfront_distribution.this[0]: Still creating... [1m0s elapsed]
╷
│ Error: reading ACM Certificate (arn:aws:acm:us-east-1:***:certificate/ARN_PLACEHOLDER): couldn't find resource
│ 
│   with aws_acm_certificate_validation.certificate_validator,
│   on acm.tf line 33, in resource "aws_acm_certificate_validation" "certificate_validator":
│   33: resource "aws_acm_certificate_validation" "certificate_validator" {
│ 
╵
╷
│ Error: error creating CloudFront Distribution: InvalidViewerCertificate: The certificate that is attached to your distribution doesn't cover the alternate domain name (CNAME) that you're trying to add. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements
│   status code: 400, request id: blabla
│ 
│   with module.cdn.aws_cloudfront_distribution.this[0],
│   on .terraform/modules/cdn/main.tf line 15, in resource "aws_cloudfront_distribution" "this":
│   15: resource "aws_cloudfront_distribution" "this" {
│ 
╵
Releasing state lock. This may take a few moments...

如果我 go 到我的 AWS 帳戶並檢查證書：

因此，如果證書有效並放置在us-east-1中，我哪里錯了？

Answer 1

我解決了這個問題：

resource "aws_acm_certificate_validation" "certificate_validator" {
  provider                = aws.virginia
  certificate_arn         = aws_acm_certificate.primary.arn
  validation_record_fqdns = [aws_route53_record.certificate_validator_record.fqdn]
}

問題是我的證書驗證是在我的默認區域而不是us-east-1區域配置的（作為我的證書）