{"id":13677164,"url":"https://github.com/terraform-aws-modules/terraform-aws-acm","last_synced_at":"2025-04-08T09:07:34.167Z","repository":{"id":37451051,"uuid":"161644064","full_name":"terraform-aws-modules/terraform-aws-acm","owner":"terraform-aws-modules","description":"Terraform module to create AWS ACM resources 🇺🇦","archived":false,"fork":false,"pushed_at":"2025-03-29T23:07:57.000Z","size":148,"stargazers_count":190,"open_issues_count":0,"forks_count":236,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-04-01T07:51:44.174Z","etag":null,"topics":["aws","aws-acm","aws-acm-certificate","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/terraform-aws-modules/acm/aws","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/terraform-aws-modules.png","metadata":{"funding":{"github":["antonbabenko"],"custom":"https://www.paypal.me/antonbabenko"},"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-13T13:35:40.000Z","updated_at":"2025-03-14T10:36:23.000Z","dependencies_parsed_at":"2023-02-01T06:31:09.945Z","dependency_job_id":"6e015757-f1b2-4269-84d6-0cf3ec8ccdbb","html_url":"https://github.com/terraform-aws-modules/terraform-aws-acm","commit_stats":{"total_commits":98,"total_committers":22,"mean_commits":4.454545454545454,"dds":0.5306122448979591,"last_synced_commit":"0ca52d1497e5a54ed86f9daac0440d27afc0db8b"},"previous_names":[],"tags_count":42,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-acm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-acm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-acm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-acm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/terraform-aws-modules","download_url":"https://codeload.github.com/terraform-aws-modules/terraform-aws-acm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247809962,"owners_count":20999816,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-acm","aws-acm-certificate","terraform-module"],"created_at":"2024-08-02T13:00:37.887Z","updated_at":"2025-04-08T09:07:34.146Z","avatar_url":"https://github.com/terraform-aws-modules.png","language":"HCL","funding_links":["https://github.com/sponsors/antonbabenko","https://www.paypal.me/antonbabenko"],"categories":["HCL"],"sub_categories":[],"readme":"# AWS Certificate Manager (ACM) Terraform module\n\nTerraform module which creates ACM certificates and validates them using Route53 DNS (recommended) or e-mail.\n\n[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)\n\n## Usage with Route53 DNS validation (recommended)\n\n```hcl\nmodule \"acm\" {\n  source  = \"terraform-aws-modules/acm/aws\"\n  version = \"~\u003e 4.0\"\n\n  domain_name  = \"my-domain.com\"\n  zone_id      = \"Z2ES7B9AZ6SHAE\"\n\n  validation_method = \"DNS\"\n\n  subject_alternative_names = [\n    \"*.my-domain.com\",\n    \"app.sub.my-domain.com\",\n  ]\n\n  wait_for_validation = true\n\n  tags = {\n    Name = \"my-domain.com\"\n  }\n}\n```\n\n## Usage with external DNS validation (e.g. CloudFlare)\n\n```hcl\nmodule \"acm\" {\n  source  = \"terraform-aws-modules/acm/aws\"\n  version = \"~\u003e 4.0\"\n\n  domain_name = \"weekly.tf\"\n  zone_id     = \"b7d259641bf30b89887c943ffc9d2138\"\n\n  validation_method = \"DNS\"\n\n  subject_alternative_names = [\n    \"*.weekly.tf\",\n  ]\n\n  create_route53_records  = false\n  validation_record_fqdns = [\n    \"_689571ee9a5f9ec307c512c5d851e25a.weekly.tf\",\n  ]\n\n  tags = {\n    Name = \"weekly.tf\"\n  }\n}\n\n```\n\n## [Usage with CloudFront](https://aws.amazon.com/premiumsupport/knowledge-center/install-ssl-cloudfront/)\n\n```hcl\n# CloudFront supports US East (N. Virginia) Region only.\nprovider \"aws\" {\n  alias  = \"us-east-1\"\n  region = \"us-east-1\"\n}\n\nmodule \"acm\" {\n  source = \"terraform-aws-modules/acm/aws\"\n\n  providers = {\n    aws = aws.us-east-1\n  }\n\n  domain_name = \"my-domain.com\"\n  zone_id     = \"Z266PL4W4W6MSG\"\n\n  validation_method = \"DNS\"\n\n  wait_for_validation = true\n\n  tags = {\n    Name = \"my-domain.com\"\n  }\n}\n```\n\n## Usage with Route53 DNS validation and separate AWS providers\n\n```hcl\nprovider \"aws\" {\n  alias = \"acm\"\n}\n\nprovider \"aws\" {\n  alias = \"route53\"\n}\n\nmodule \"acm\" {\n  source  = \"terraform-aws-modules/acm/aws\"\n  version = \"~\u003e 4.0\"\n\n  providers = {\n    aws = aws.acm\n  }\n\n  domain_name  = \"my-domain.com\"\n\n  subject_alternative_names = [\n    \"*.my-domain.com\",\n    \"app.sub.my-domain.com\",\n  ]\n\n  validation_method = \"DNS\"\n\n  create_route53_records  = false\n  validation_record_fqdns = module.route53_records.validation_route53_record_fqdns\n}\n\nmodule \"route53_records\" {\n  source  = \"terraform-aws-modules/acm/aws\"\n  version = \"~\u003e 4.0\"\n\n  providers = {\n    aws = aws.route53\n  }\n\n  create_certificate          = false\n  create_route53_records_only = true\n\n  validation_method = \"DNS\"\n\n  distinct_domain_names = module.acm.distinct_domain_names\n  zone_id               = \"Z266PL4W4W6MSG\"\n\n  acm_certificate_domain_validation_options = module.acm.acm_certificate_domain_validation_options\n}\n```\n\n## Examples\n\n- [Complete example with DNS validation (recommended)](https://github.com/terraform-aws-modules/terraform-aws-acm/tree/master/examples/complete-dns-validation)\n- [Complete example with DNS validation via external DNS provider (CloudFlare)](https://github.com/terraform-aws-modules/terraform-aws-acm/tree/master/examples/complete-dns-validation-with-cloudflare)\n- [Complete example with EMAIL validation](https://github.com/terraform-aws-modules/terraform-aws-acm/tree/master/examples/complete-email-validation)\n- [Complete example with EMAIL validation and validation domain override](https://github.com/terraform-aws-modules/terraform-aws-acm/tree/master/examples/complete-email-validation-with-validation-domain)\n\n## Conditional creation and validation\n\nSometimes you need to have a way to create ACM certificate conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_certificate`.\n\n```hcl\nmodule \"acm\" {\n  source = \"terraform-aws-modules/acm/aws\"\n\n  create_certificate = false\n  # ... omitted\n}\n```\n\nSimilarly, to disable DNS validation of ACM certificate:\n\n```hcl\nmodule \"acm\" {\n  source = \"terraform-aws-modules/acm/aws\"\n\n  validate_certificate = false\n  # ... omitted\n}\n```\n\n## Notes\n\n- For use in an automated pipeline consider setting the `wait_for_validation = false` to avoid waiting for validation to complete or error after a 45 minute timeout.\n- If you're upgrading to [v2.13.0](https://github.com/terraform-aws-modules/terraform-aws-acm/releases/v2.13.0) or above, you might be subject to [off-by-one validation record issue](https://github.com/terraform-aws-modules/terraform-aws-acm/pull/47#issuecomment-754778599). You can solve this without compromising existing validation records by issuing `terraform state rm \u003cyour_module_name\u003e.validation[1]` where `[1]` can be a different index # depending on the number of validation records your module creates (you can check this with `terraform state list module.\u003cyour_module_name\u003e.validation`).\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 4.40 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 4.40 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_acm_certificate.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |\n| [aws_acm_certificate_validation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate_validation) | resource |\n| [aws_route53_record.validation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_acm_certificate_domain_validation_options\"\u003e\u003c/a\u003e [acm\\_certificate\\_domain\\_validation\\_options](#input\\_acm\\_certificate\\_domain\\_validation\\_options) | A list of domain\\_validation\\_options created by the ACM certificate to create required Route53 records from it (used when create\\_route53\\_records\\_only is set to true) | `any` | `{}` | no |\n| \u003ca name=\"input_certificate_transparency_logging_preference\"\u003e\u003c/a\u003e [certificate\\_transparency\\_logging\\_preference](#input\\_certificate\\_transparency\\_logging\\_preference) | Specifies whether certificate details should be added to a certificate transparency log | `bool` | `true` | no |\n| \u003ca name=\"input_create_certificate\"\u003e\u003c/a\u003e [create\\_certificate](#input\\_create\\_certificate) | Whether to create ACM certificate | `bool` | `true` | no |\n| \u003ca name=\"input_create_route53_records\"\u003e\u003c/a\u003e [create\\_route53\\_records](#input\\_create\\_route53\\_records) | When validation is set to DNS, define whether to create the DNS records internally via Route53 or externally using any DNS provider | `bool` | `true` | no |\n| \u003ca name=\"input_create_route53_records_only\"\u003e\u003c/a\u003e [create\\_route53\\_records\\_only](#input\\_create\\_route53\\_records\\_only) | Whether to create only Route53 records (e.g. using separate AWS provider) | `bool` | `false` | no |\n| \u003ca name=\"input_distinct_domain_names\"\u003e\u003c/a\u003e [distinct\\_domain\\_names](#input\\_distinct\\_domain\\_names) | List of distinct domains and SANs (used when create\\_route53\\_records\\_only is set to true) | `list(string)` | `[]` | no |\n| \u003ca name=\"input_dns_ttl\"\u003e\u003c/a\u003e [dns\\_ttl](#input\\_dns\\_ttl) | The TTL of DNS recursive resolvers to cache information about this record. | `number` | `60` | no |\n| \u003ca name=\"input_domain_name\"\u003e\u003c/a\u003e [domain\\_name](#input\\_domain\\_name) | A domain name for which the certificate should be issued | `string` | `\"\"` | no |\n| \u003ca name=\"input_key_algorithm\"\u003e\u003c/a\u003e [key\\_algorithm](#input\\_key\\_algorithm) | Specifies the algorithm of the public and private key pair that your Amazon issued certificate uses to encrypt data | `string` | `null` | no |\n| \u003ca name=\"input_putin_khuylo\"\u003e\u003c/a\u003e [putin\\_khuylo](#input\\_putin\\_khuylo) | Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo! | `bool` | `true` | no |\n| \u003ca name=\"input_subject_alternative_names\"\u003e\u003c/a\u003e [subject\\_alternative\\_names](#input\\_subject\\_alternative\\_names) | A list of domains that should be SANs in the issued certificate | `list(string)` | `[]` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A mapping of tags to assign to the resource | `map(string)` | `{}` | no |\n| \u003ca name=\"input_validate_certificate\"\u003e\u003c/a\u003e [validate\\_certificate](#input\\_validate\\_certificate) | Whether to validate certificate by creating Route53 record | `bool` | `true` | no |\n| \u003ca name=\"input_validation_allow_overwrite_records\"\u003e\u003c/a\u003e [validation\\_allow\\_overwrite\\_records](#input\\_validation\\_allow\\_overwrite\\_records) | Whether to allow overwrite of Route53 records | `bool` | `true` | no |\n| \u003ca name=\"input_validation_method\"\u003e\u003c/a\u003e [validation\\_method](#input\\_validation\\_method) | Which method to use for validation. DNS or EMAIL are valid. This parameter must not be set for certificates that were imported into ACM and then into Terraform. | `string` | `null` | no |\n| \u003ca name=\"input_validation_option\"\u003e\u003c/a\u003e [validation\\_option](#input\\_validation\\_option) | The domain name that you want ACM to use to send you validation emails. This domain name is the suffix of the email addresses that you want ACM to use. | `any` | `{}` | no |\n| \u003ca name=\"input_validation_record_fqdns\"\u003e\u003c/a\u003e [validation\\_record\\_fqdns](#input\\_validation\\_record\\_fqdns) | When validation is set to DNS and the DNS validation records are set externally, provide the fqdns for the validation | `list(string)` | `[]` | no |\n| \u003ca name=\"input_validation_timeout\"\u003e\u003c/a\u003e [validation\\_timeout](#input\\_validation\\_timeout) | Define maximum timeout to wait for the validation to complete | `string` | `null` | no |\n| \u003ca name=\"input_wait_for_validation\"\u003e\u003c/a\u003e [wait\\_for\\_validation](#input\\_wait\\_for\\_validation) | Whether to wait for the validation to complete | `bool` | `true` | no |\n| \u003ca name=\"input_zone_id\"\u003e\u003c/a\u003e [zone\\_id](#input\\_zone\\_id) | The ID of the hosted zone to contain this record. Required when validating via Route53 | `string` | `\"\"` | no |\n| \u003ca name=\"input_zones\"\u003e\u003c/a\u003e [zones](#input\\_zones) | Map containing the Route53 Zone IDs for additional domains. | `map(string)` | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_acm_certificate_arn\"\u003e\u003c/a\u003e [acm\\_certificate\\_arn](#output\\_acm\\_certificate\\_arn) | The ARN of the certificate |\n| \u003ca name=\"output_acm_certificate_domain_validation_options\"\u003e\u003c/a\u003e [acm\\_certificate\\_domain\\_validation\\_options](#output\\_acm\\_certificate\\_domain\\_validation\\_options) | A list of attributes to feed into other resources to complete certificate validation. Can have more than one element, e.g. if SANs are defined. Only set if DNS-validation was used. |\n| \u003ca name=\"output_acm_certificate_status\"\u003e\u003c/a\u003e [acm\\_certificate\\_status](#output\\_acm\\_certificate\\_status) | Status of the certificate. |\n| \u003ca name=\"output_acm_certificate_validation_emails\"\u003e\u003c/a\u003e [acm\\_certificate\\_validation\\_emails](#output\\_acm\\_certificate\\_validation\\_emails) | A list of addresses that received a validation E-Mail. Only set if EMAIL-validation was used. |\n| \u003ca name=\"output_distinct_domain_names\"\u003e\u003c/a\u003e [distinct\\_domain\\_names](#output\\_distinct\\_domain\\_names) | List of distinct domains names used for the validation. |\n| \u003ca name=\"output_validation_domains\"\u003e\u003c/a\u003e [validation\\_domains](#output\\_validation\\_domains) | List of distinct domain validation options. This is useful if subject alternative names contain wildcards. |\n| \u003ca name=\"output_validation_route53_record_fqdns\"\u003e\u003c/a\u003e [validation\\_route53\\_record\\_fqdns](#output\\_validation\\_route53\\_record\\_fqdns) | List of FQDNs built using the zone domain and name. |\n\u003c!-- END_TF_DOCS --\u003e\n\n## Authors\n\nModule is maintained by [Anton Babenko](https://github.com/antonbabenko) with help from [these awesome contributors](https://github.com/terraform-aws-modules/terraform-aws-acm/graphs/contributors).\n\n## License\n\nApache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-acm/tree/master/LICENSE) for full details.\n\n## Additional information for users from Russia and Belarus\n\n* Russia has [illegally annexed Crimea in 2014](https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation) and [brought the war in Donbas](https://en.wikipedia.org/wiki/War_in_Donbas) followed by [full-scale invasion of Ukraine in 2022](https://en.wikipedia.org/wiki/2022_Russian_invasion_of_Ukraine).\n* Russia has brought sorrow and devastations to millions of Ukrainians, killed hundreds of innocent people, damaged thousands of buildings, and forced several million people to flee.\n* [Putin khuylo!](https://en.wikipedia.org/wiki/Putin_khuylo!)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-aws-modules%2Fterraform-aws-acm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fterraform-aws-modules%2Fterraform-aws-acm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-aws-modules%2Fterraform-aws-acm/lists"}