TerraformでACMの証明書発行とDNS検証を自動化する設計｜aws_acm_certificate_validationの依存関係と発行待ちの実践

この記事のポイント

・aws_acm_certificate_validationは証明書リソースとRoute 53 CNAMEレコード両方に依存する
・for_eachでdomain_validation_optionsを展開すると検証レコードを自動生成できる
・CloudFront用証明書はprovider = aws.us_east_1のalias設計が必須
・DNS検証がタイムアウトするときはRoute 53ゾーンのNameserver一致を最初に疑う

# 証明書リソース
resource "aws_acm_certificate" "this" {
  domain_name       = var.domain_name          # 例: example.com
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true               # 証明書差し替え時のダウンタイム防止
  }
}

# Route 53ゾーン参照（既存ゾーンをdata sourceで取得）
data "aws_route53_zone" "this" {
  name         = var.hosted_zone_name    # 例: "example.com."
  private_zone = false
}

# DNS検証レコード（CNAMEをRoute 53に登録）
resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.this.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.this.zone_id
}

# 証明書発行完了の待機
resource "aws_acm_certificate_validation" "this" {
  certificate_arn         = aws_acm_certificate.this.arn
  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
}

# ALBのHTTPSリスナー（証明書発行完了後にアタッチ）
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.this.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"

  # aws_acm_certificate.this.arn ではなく validation 完了後の ARN を参照する
  certificate_arn = aws_acm_certificate_validation.this.certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.this.arn
  }
}

resource "aws_acm_certificate" "this" {
  domain_name               = var.domain_name             # 例: example.com
  subject_alternative_names = ["*.${var.domain_name}"]   # ワイルドカード追加

  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_acm_certificate" "this" {
  domain_name = "example.com"
  subject_alternative_names = [
    "*.example.com",
    "api.example.net",
    "www.example.net",
  ]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

# 複数ゾーンを扱う場合のdata source
data "aws_route53_zone" "zones" {
  for_each = toset(["example.com", "example.net"])
  name         = each.value
  private_zone = false
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.this.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
      # ドメインの末尾2ラベルでゾーンを選択する
      zone_id = data.aws_route53_zone.zones[
        join(".", slice(
          split(".", dvo.domain_name),
          length(split(".", dvo.domain_name)) - 2,
          length(split(".", dvo.domain_name))
        ))
      ].zone_id
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = each.value.zone_id
}

# プロバイダー定義（通常のリージョンとus-east-1の2つを定義）
provider "aws" {
  region = "ap-northeast-1"    # 東京（デフォルト）
}

provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"         # CloudFront証明書用
}

# CloudFront向け証明書（us-east-1で発行）
resource "aws_acm_certificate" "cloudfront" {
  provider = aws.us_east_1     # このリソースだけus-east-1を使う

  domain_name               = var.domain_name
  subject_alternative_names = ["*.${var.domain_name}"]
  validation_method         = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

# DNS検証レコード（Route 53はリージョン非依存なのでデフォルトプロバイダーでOK）
resource "aws_route53_record" "cloudfront_cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.cloudfront.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }
  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.this.zone_id
}

# CloudFront向け証明書発行待ち（プロバイダーはus-east-1を指定）
resource "aws_acm_certificate_validation" "cloudfront" {
  provider                = aws.us_east_1
  certificate_arn         = aws_acm_certificate.cloudfront.arn
  validation_record_fqdns = [for record in aws_route53_record.cloudfront_cert_validation : record.fqdn]
}

# CloudFrontディストリビューション（証明書ARNはvalidation完了後を参照）
resource "aws_cloudfront_distribution" "this" {
  # ... 他の設定 ...
  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate_validation.cloudfront.certificate_arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

resource "aws_acm_certificate_validation" "this" {
  certificate_arn         = aws_acm_certificate.this.arn
  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]

  timeouts {
    create = "75m"    # デフォルト45分を75分に延長
  }
}

# ドメインの現在のNameserverを確認
$ dig example.com NS +short
ns-123.awsdns-45.com.
ns-678.awsdns-90.net.
ns-1234.awsdns-56.org.
ns-789.awsdns-01.co.uk.

# Route 53ゾーンのNameserverと照合
$ aws route53 list-resource-record-sets   --hosted-zone-id Z1234567890EXAMPLE   --query "ResourceRecordSets[?Type=='NS'].ResourceRecords[].Value"   --output text
ns-123.awsdns-45.com.
ns-678.awsdns-90.net.
ns-1234.awsdns-56.org.
ns-789.awsdns-01.co.uk.

Error: [ERR]: Error building changeset: InvalidChangeBatch:
[RRSet of type CNAME with DNS name _abc123.example.com. is
not permitted as it conflicts with other records with that DNS name]

# ステップ1：証明書リソースだけ作成
$ terraform apply -target=aws_acm_certificate.this

# ステップ2：DNS検証レコードを作成
$ terraform apply -target=aws_route53_record.cert_validation

# ステップ3：残り全部（aws_acm_certificate_validation含む）を適用
$ terraform apply