aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::CertificateManager::Certificate (Resource timeout)

Open
#130 3 comments 7 reactions 0 assignees View on GitHub
enhancement networking & content deliv
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

## 2. Scope of request

Currently, ACM certificate resources seem to have a ~12 hour timeout. This causes stack operations to fail if the certificate is not validated within that 12 hour window.

## 3. Expected behavior

When creating ACM certificates through the Console or other methods, the certificates will remain in the `Pending validation` state indefinitely. This is the ideal behavior, especially with DNS validation, since there are cases where it can take several days for the validation DNS records to be communicated to the correct people and deployed. This is particularly true when the certificates are being created on behalf of a third party.

Based on the [CloudFormation documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html):

>By default, there is no timeout for stack creation. However, individual resources may have their own timeouts based on the nature of the service they implement.

This would seem like a situation where the resource would **not** have a timeout, given the nature of the certificate validation process.

## 6. Category (required) - Will help with tagging and be easier to find by other users to +1

8. Security (IAM, KMS...)

## 7. Any additional context (optional)

Here is an example of the event log for a stack that created an ACM certificate that went unvalidated for a number of hours

![Screen-Shot-2019-08-17-at-8 16 28-AM](https://user-images.githubusercontent.com/3483/63211614-8ee66700-c0c7-11e9-995e-131022ea79be.jpg)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the ACM certificate resource behavior described in the issue and the linked CloudFormation documentation, then examine how pending validation is currently timed out. Done means an unvalidated certificate can remain in Pending validation indefinitely, including when DNS validation takes several days.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.