By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

CDK problem creating a certificate for an ApplicationLoadBalancedFargateService in gov cloud

0

I have a cdk template that has been working as expected for some time. I am in the process to setting up the same in govcloud and I am running into the problem that the deployment is stuck while creating the certificate that the alb will use. The tree view of the resources in CF console has all the resources creation as completed except the certificate.

The certificate uses a hosted zone in the template for its creation. The hosted zone in the govcloud is gov.xxx.yyy, The gov cloud account is linked to an standard aws account with two public hosted zones: xxx.yyy, and gov.xxx.yyy

The template successfully creates the route53 records in the govcloud.

My impression is that the validation is not working but not sure why.

  • co5
    10 months ago

    there are two things that remain foggy to me. How is the roundtripping of the route53 validation in govcloud? These are private hosted zones. Does the validation leave the partition's route53? Does it use the linked standard account to reach out the TLD and then come back to the private hosted zone using the public hosted zone (I have the gov cloud name servers there and nothing else) ?

    Can VPCs in govcloud share private hosted zones? or does each vpc require its own hosted zone?

Topics
Management & GovernanceGovernment
Tags
AWS CloudFormationGovernment
Language
English
co5
asked 10 months ago422 views
3 Answers
0
Accepted Answer

Creating acm certificates on the fly using CDK in govcloud is not advisable because the dns validation needs a public hosted zone entry, which govcloud does not have. In addition, the certs quota can hit the environment at the least expected moment. The most straight forward way to do this is:

To create a cert manually in the govcloud account, using dns validation and the linked aws account's public hosted zone/domain. The the cert's arn can be used in CDK without problems.

co5
answered 10 months ago
profile picture
EXPERT
Sedat Salman
reviewed 9 months ago
0

Hi, did you check that you gov cloud region supports ACM service endpoint ? For the list, see https://docs.aws.amazon.com/general/latest/gr/acm.html

profile pictureAWS
EXPERT
Didier_Durand
answered 10 months ago
profile picture
EXPERT
Sedat Salman
reviewed 9 months ago
  • co5
    10 months ago

    the endpoints are there for both govcloud regions. thanks!

0

If getting stuck at ACM level is mostly related to its validation. Are you using email or dns to perform validation?

profile picture
EXPERT
Antonio_Lagrotteria
answered 10 months ago
  • co5
    10 months ago

    The cert is created by CDK using the hosted zone data. It works in the standard aws cloud. Logic dictates that validations should occur via dns. I can see the validation record in the gov route53. It strikes me a as a DNS problem that I introduced. There are two places that might be the problem (nothing like being away from the keyboard for ideas to pop up) thanks!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content