Skip to main content
Type: rvn-acm-certificate · Latest version: 0.3.1

​
Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

​
Readme

ACM certificate requests an AWS Certificate Manager public certificate with DNS validation.

​
Overview

Use this module when an application, load balancer, or CloudFront distribution needs a public TLS certificate managed by AWS Certificate Manager. The module creates the ACM certificate request, exposes DNS validation records, and can optionally create Route53 validation records and wait until ACM issues the certificate. By default, the module does not create DNS records and does not block the apply waiting for issuance. This keeps first-time provisioning useful when DNS is managed outside the stack or when validation records need to be copied into another provider.

​
Use cases

​
Certificate domains

The required Domain name field is the primary fully qualified domain name for the certificate, such as api.example.com. Subject alternative names add more FQDNs to the same certificate. Do not repeat the primary domain name in this list. ACM rejects invalid duplicate domain combinations.

​
DNS validation

ACM public certificates use DNS validation. The stack outputs validation record details after apply so you can create the required CNAME records wherever DNS is managed. Enable Create Route53 validation records when the validation records should be created automatically in one Route53 public hosted zone. When that option is enabled, Route53 hosted zone ID is required. Enable Wait for certificate issuance only when DNS validation can complete during the apply. If DNS is external or validation records will be added later, leave it off so the stack can finish while the certificate remains pending validation.

​
Regional behavior

Choose the AWS Region based on where the certificate will be used:

​
Configuration

​
Design decisions

The default mode favors non-blocking certificate requests. It creates the ACM certificate and returns DNS validation records without assuming DNS is managed by Route53 or available during the first apply. Route53 automation is intentionally scoped to a single hosted zone. If SANs require validation records in multiple zones, leave Route53 automation off and create the returned validation records in the appropriate DNS zones. Ravion adds standard tags for ownership and traceability. User-provided Tags are merged on top for team, cost, or environment metadata.

​
Learn more

​
Inputs reference

All inputs for rvn-acm-certificate version 0.3.1. Use the name shown for each field as the input key in module config.

​
AWS account & region

​
aws_account_id
string
required
AWS account.
  • Immutable after creation
​
aws_region
string
required
Region. Must be the same region as the load balancer, or us-east-1 for CloudFront.
  • Immutable after creation

​
Certificate

​
name
string
required
Name slug. Name prefix used for tagging the ACM certificate.
  • Default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
  • Pattern: ^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$ — Use 1-64 lowercase letters, numbers, or hyphens, starting and ending with a letter or number.
​
domain_name
string
required
Domain name. Primary fully qualified domain name for the ACM certificate.
  • Immutable after creation
​
subject_alternative_names
string_array
Subject alternative names. Additional fully qualified domain names to include on the certificate.
  • Immutable after creation

​
DNS validation

​
route53_validation_records_creation_enabled
boolean
Create Route53 validation records. Use only when the domain already has a Route53 public hosted zone and all primary/SAN validation records belong in that zone.
  • Default: false
  • Immutable after creation
​
route53_zone_id
string
required
Route53 hosted zone ID. Public hosted zone used for validation records. Required when Route53 validation records are enabled.
  • Immutable after creation
  • Pattern: ^Z[0-9A-Z]+$ — Use a valid Route53 hosted zone ID, for example Z1234567890ABC.
  • Shown when: {"route53_validation_records_creation_enabled":true}
​
certificate_validation_wait_enabled
boolean
Wait for certificate issuance. Wait for ACM to issue the certificate during apply. Enable after DNS validation can complete.
  • Default: false

​
Misc

​
tags
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
opentofu_version
string
OpenTofu version override. Override the environment’s default version for this module
​
ravion_state_backend_workspace
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
advanced_terraform_variables
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}
​
execution_environment_id
string
Terraform execution environment. Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.