aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::CertificateManager::Certificate (Resource timeout)
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
## 2. Scope of request
Currently, ACM certificate resources seem to have a ~12 hour timeout. This causes stack operations to fail if the certificate is not validated within that 12 hour window.
## 3. Expected behavior
When creating ACM certificates through the Console or other methods, the certificates will remain in the `Pending validation` state indefinitely. This is the ideal behavior, especially with DNS validation, since there are cases where it can take several days for the validation DNS records to be communicated to the correct people and deployed. This is particularly true when the certificates are being created on behalf of a third party.
Based on the [CloudFormation documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html):
>By default, there is no timeout for stack creation. However, individual resources may have their own timeouts based on the nature of the service they implement.
This would seem like a situation where the resource would **not** have a timeout, given the nature of the certificate validation process.
## 6. Category (required) - Will help with tagging and be easier to find by other users to +1
8. Security (IAM, KMS...)
## 7. Any additional context (optional)
Here is an example of the event log for a stack that created an ACM certificate that went unvalidated for a number of hours

Contributor guide
Research direction
Start by reviewing the ACM certificate resource behavior described in the issue and the linked CloudFormation documentation, then examine how pending validation is currently timed out. Done means an unvalidated certificate can remain in Pending validation indefinitely, including when DNS validation takes several days.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100