Certificate

Source: src/AWS/ACM/Certificate.ts

An ACM certificate for CloudFront and other AWS endpoints.

Certificate requests an ACM certificate in us-east-1, which is the region required for CloudFront viewer certificates. When hostedZoneId is provided for DNS validation, the provider creates or updates the Route 53 validation records and waits for the certificate to be issued.

Requesting Certificates

DNS-Validated Certificate

const cert = yield* Certificate("WebsiteCertificate", {
  domainName: "www.example.com",
  hostedZoneId: "Z1234567890",
});

Certificate With SANs

const cert = yield* Certificate("WebsiteCertificate", {
  domainName: "example.com",
  subjectAlternativeNames: ["www.example.com"],
  hostedZoneId: "Z1234567890",
});

Exportable Certificate

// `export: "ENABLED"` lets the ExportCertificate binding retrieve the
// certificate together with its (encrypted) private key at runtime.
const cert = yield* Certificate("ExportableCertificate", {
  domainName: "www.example.com",
  hostedZoneId: "Z1234567890",
  export: "ENABLED",
});

Certificate Expiry Events

// ACM emits "ACM Certificate Approaching Expiration" events through
// EventBridge — consume them with the ACM expiry event source, scoped
// to this certificate.
yield* AWS.ACM.consumeExpiryEvents(
  { certificateArns: [cert.certificateArn] },
  (events) =>
    Stream.runForEach(events, (event) =>
      Effect.log(
        `${event.detail.CommonName} expires in ${event.detail.DaysToExpiry} days`,
      ),
    ),
);