By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Can't Delete Certificate because there are Dangling Load Balancer Resources

0

Hello AWS,

I have a custom domain (registered via Route53) and created API Gateway resources for this custom domain yesterday.

After deleting ALL (!!!) API Gateway resources and even doing an "aws-nuke" on my account, I still have API Gateway load balancers associated with my ACM certificate.

The ARNs for the load balancer resources look like this: "arn:aws:elasticloadbalancing:eu-central-1:<some-aws-account-id>:loadbalancer/app/prod-fra-1-az1-1-31/<some-mores-stuff>"

This is annoying as I cannot delete the certificate as long as these association hold.

Can anybody help me with this?

Best, David

Topics
Networking & Content DeliveryServerlessFront-End Web & MobileSecurity, Identity, & Compliance
Tags
Gateway Load BalancerAmazon API GatewayAWS Certificate Manager
Language
English
maehster
asked 3 years ago3551 views
2 Answers
1
Accepted Answer

When you associate an ACM certificate with an API Gateway, the service creates the backing resource (CF Distro or ALB, depending on your API GW deployment). Although you have deleted the API GW resource on your end, unfortunately the association hasn't been removed on the backing-resource end.

So, how do you fix this? Raise a case with AWS Premium Support, under the ACM service. If you're not currently paying for a support plan (Dev, Business, or Ent) then simply raise a case with Customer Support (covered by the free-tier support plan) and simply link them to this forum question. From there, they can reach out to the ACM support team and get the association removed for you.

Also, in case cost is a concern - ACM public certs are free of charge, so no cost is being incurred by you for having the cert remain in your account.

profile pictureAWS
Ciaran Carragher
answered 3 years ago
profile picture
EXPERT
Adeleke Adebowale J
reviewed 2 months ago
  • maehster
    3 years ago

    Thanks for answering, will do that. Thought I might have missed something but already had the feeling that it's a bug.

0

There might be an API Gateway custom domain associated with the certificate. To remove the binding and allow ACM to delete your certificate, you need to remove the API Gateway custom domain first.

See: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-resources/

AWS
Naj_AWS
answered 3 years ago
  • maehster
    3 years ago

    Please read the question carefully. I deleted EVERYTHING else in my account and the resources are still there. So I don't have ANYTHING in my API Gateway service and in any other service.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content