aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::CertificateManager::Certificate - Region
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
## 1. Title
AWS::CertificateManager::Certificate - Region
Add new parameter for EDGE or REGIONAL (default REGIONAL).
Samples:
```
SslCertificate:
Type: AWS::CertificateManager::Certificate
Properties:
DomainName: domain.com
SubjectAlternativeNames:
- *.domain.com
ValidationMethod: DNS
Region: GLOBAL
DomainValidationOptions:
- DomainName: domain.com
HostedZoneId: 123456789ABC
```
## 2. Scope of request
When I want to create one single stack with Cognito custom domain, or CloudFront I need to create the certificate in us-east-1 manually first. But I would like to have my certificate to be deployed from within the same CloudFormation template with my Cognito/ApiGateway...etc
Current behaviour for Cognito custom domain even if I deploy the Cfn stack in other regions such as ap-southeast-1, it is actually deployed it into us-east-1 as it is global resource via Edge location (if I am not mistaken).
However, this will require me to deploy the one environment in two separate regions. Having a centralized Cfn will allow management part so much easier.
The biggest issue of no support multi-region properly is that if there is a bug happen in the template, it cannot fully rollback properly, also rolling out a new update of certs (e.g. add a new alternative name) will change the ARN. if I have a multi-account environment (I have 10 environments planned). manage all ACM Arn one by one can add a lot of overhead and issue
## 3. Expected behaviour
With the additional parameter mark it as global, the certificate can be used by CloudFront. Even if everything deploys in a different region
## 4. Suggest specific test cases
as mentioned in section 3.
## 5. Helpful Links to speed up research and evaluation
* Look for "Virginia" in the following docs
https://aws.amazon.com/premiumsupport/knowledge-center/custom-ssl-certificate-cloudfront/
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html
Also for the sake of consistency, we can copy AWS::ApiGateway::RestApi EndpointConfiguration parameter format to use Edge, Regional as the option
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-restapi-endpointconfiguration.html
## 6. Category (required) - Will help with tagging and be easier to find by other users to +1
1. Compute
4. Networking & Content
5. Management
8. Security
Contributor guide
Research direction
Start with the AWS CloudFront, Cognito, API Gateway, and EndpointConfiguration documentation linked in the issue, focusing on the Virginia/us-east-1 requirement and the Edge/Regional format. The issue names no repository files or tests, so locate the relevant AWS::CertificateManager::Certificate coverage and existing parameter tests before proceeding. Done means the requested regional behavior and explicit test cases are defined and supported without separate certificate deployment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100