Static site cloud formation template creation failing to create certificate

Question

I'm trying to follow these instructions with a domain I bought in Route 53: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/getting-started-secure-static-website-cloudformation-template.html

But every time I run it, I get the error`Embedded stack arn:aws:cloudformation:us-east-1:378135112859:stack/amazon-cloudfront-secure-static-site-vl2-test5-AcmCertificateStack-SU36T7Q937HA/8b734f60-416f-11ef-8bd6-0afff044c08b was not successfully created: The following resource(s) failed to create: [Certificate].`

I tried creating a certificate manually in ACM manager, and that worked, for the same domain and subdomain. But still the stack creation fails. I've tried with Create Apex as yes and no and it doesn't seem to help.

Is there some easier way to create a static site? I feel like this is extremely basic functionality. In Google Cloud I can do it in like 2 steps. Why is it so complicated in AWS? How do I get better error messages that can actually tell me *why* the certificate creation failed?

EDIT: I found a more detailed message, although it's still not very helpful: `[RRSet with DNS name _1ef508b345bb2bd302d0a1d55d1d6940.test.---.com. is not permitted in zone ---.com., RRSet with DNS name _858a6f8f5ac21f375925a6703d8239cb.---.com. is not permitted in zone ---.com.] (Service: AmazonRoute53; Status Code: 400; Error Code: InvalidChangeBatch; Request ID: 829b3b76-ed81-400d-9d63-d75aa3c27c65; Proxy: null)`

EDIT 2: Even more info from CloudTrail:

```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "invokedBy": "cloudformation.amazonaws.com"
    },
    "eventTime": "2024-07-13T23:28:36Z",
    "eventSource": "route53.amazonaws.com",
    "eventName": "ChangeResourceRecordSets",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "cloudformation.amazonaws.com",
    "userAgent": "cloudformation.amazonaws.com",
    "errorCode": "InvalidChangeBatch",
    "errorMessage": "[RRSet with DNS name _1ef508b345bb---.test.---.com. is not permitted in zone ---.com., RRSet with DNS name _858a6f8f5a---.---.com. is not permitted in zone ---.com.]",
    "requestParameters": {
        "hostedZoneId": "Z10---LBV",
        "changeBatch": {
            "changes": [
                {
                    "action": "UPSERT",
                    "resourceRecordSet": {
                        "name": "_1ef508b34---xx.test.---.com.",
                        "type": "CNAME",
                        "tTL": 300,
                        "resourceRecords": [
                            {
                                "value": "_91926a211---xx.sdgjtdhdhz.acm-validations.aws."
                            }
                        ]
                    }
                },
                {
                    "action": "UPSERT",
                    "resourceRecordSet": {
                        "name": "_858a6f8f---39cb.---.com.",
                        "type": "CNAME",
                        "tTL": 300,
                        "resourceRecords": [
                            {
                                "value": "_78ed82c22---x.sdgjtdhdhz.acm-validations.aws."
                            }
                        ]
                    }
                }
            ]
        }
    },
    "responseElements": null,
    "additionalEventData": {
        "Note": "Do not use to reconstruct hosted zone"
    },
    "requestID": "---",
    "eventID": "---",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "apiVersion": "2013-04-01",
    "managementEvent": true,
    "recipientAccountId": "---xx",
    "eventCategory": "Management",
    "sessionCredentialFromConsole": "true"
}
```

I tried then creating those same records in the Route 53 UI and it worked fine. So could it be some kind of permissions issue?

EDIT 3:

In the CloudFormation template UI, it shows this warning:

```
The following resource(s) require capabilities: [AWS::CloudFormation::Stack]
This template contains Identity and Access Management (IAM) resources. Check that you want to create each of these resources and that they have the minimum required permissions. In addition, they have custom names. Check that the custom names are unique within your AWS account.Learn more 
For this template, AWS CloudFormation might require an unrecognized capability: CAPABILITY_AUTO_EXPAND. Check the capabilities of these resources.Learn more 
I acknowledge that AWS CloudFormation might create IAM resources with custom names.
I acknowledge that AWS CloudFormation might require the following capability: CAPABILITY_AUTO_EXPAND
```

Am I missing some kind of capability (CAPABILITY_AUTO_EXPAND)? How do I get that?

Leo K · Answer

It's hard to say without seeing what is being attempted, but what is failing is simply adding a record in the DNS zone, so it is indeed a very basic operation also in AWS and has no special reason to fail. Perhaps there might be a simple typo or incorrect parameter specified to one of the CloudFormation templates. To be sure, did you deploy the stack in the us-east-1 region as the instructions advise? It says deployment won't work in other regions.

A quick way to see exactly what was attempted would be to open the CloudTrail console, switch to the us-east-1 (N. Virginia) region, open the Event history view, and filter the events by "Event name" = "ChangeResourceRecordSets". That will show the most recent DNS changes in your account. From behind the gear symbol to the upper right, you can reveal the "Error code" column to locate requests that resulted in an error easily.

When you find the event that returned the error, you can click it open to see the full JSON log event, including the exact parameters that were given to Route 53 for the DNS change. The event will show the `hostedZoneId` of the zone that was attempted to be changed, and probably one or two "CREATE" or "UPSERT" actions for certain names.

There is likely something wrong with the actions or their parameters, or possibly the values attempted to be added are already present, since you mentioned having manually created a certificate using the same names. If so, you could delete the manually added records and try deploying the CloudFormation template again.

Static site cloud formation template creation failing to create certificate

Add your answer

Relevant content