aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::CertificateManager::Certificate - Region

Open
#523 35 comments 152 reactions 0 assignees View on GitHub
Coverage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

## 1. Title

AWS::CertificateManager::Certificate - Region

Add new parameter for EDGE or REGIONAL (default REGIONAL).

Samples:
```
SslCertificate:
Type: AWS::CertificateManager::Certificate
Properties:
DomainName: domain.com
SubjectAlternativeNames:
- *.domain.com
ValidationMethod: DNS
Region: GLOBAL
DomainValidationOptions:
- DomainName: domain.com
HostedZoneId: 123456789ABC
```

## 2. Scope of request

When I want to create one single stack with Cognito custom domain, or CloudFront I need to create the certificate in us-east-1 manually first. But I would like to have my certificate to be deployed from within the same CloudFormation template with my Cognito/ApiGateway...etc

Current behaviour for Cognito custom domain even if I deploy the Cfn stack in other regions such as ap-southeast-1, it is actually deployed it into us-east-1 as it is global resource via Edge location (if I am not mistaken).

However, this will require me to deploy the one environment in two separate regions. Having a centralized Cfn will allow management part so much easier.

The biggest issue of no support multi-region properly is that if there is a bug happen in the template, it cannot fully rollback properly, also rolling out a new update of certs (e.g. add a new alternative name) will change the ARN. if I have a multi-account environment (I have 10 environments planned). manage all ACM Arn one by one can add a lot of overhead and issue

## 3. Expected behaviour

With the additional parameter mark it as global, the certificate can be used by CloudFront. Even if everything deploys in a different region

## 4. Suggest specific test cases

as mentioned in section 3.

## 5. Helpful Links to speed up research and evaluation

* Look for "Virginia" in the following docs

https://aws.amazon.com/premiumsupport/knowledge-center/custom-ssl-certificate-cloudfront/
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html

Also for the sake of consistency, we can copy AWS::ApiGateway::RestApi EndpointConfiguration parameter format to use Edge, Regional as the option

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-restapi-endpointconfiguration.html

## 6. Category (required) - Will help with tagging and be easier to find by other users to +1

1. Compute
4. Networking & Content
5. Management
8. Security

Contributor guide

Open the contributing guide

Research direction

Start with the AWS CloudFront, Cognito, API Gateway, and EndpointConfiguration documentation linked in the issue, focusing on the Virginia/us-east-1 requirement and the Edge/Regional format. The issue names no repository files or tests, so locate the relevant AWS::CertificateManager::Certificate coverage and existing parameter tests before proceeding. Done means the requested regional behavior and explicit test cases are defined and supported without separate certificate deployment.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.