AWS Certificate Manager
Today we are going to take a look at another one of my favorite services. AWS Certificate Manager. In this exploration we are going to be interacting with JSON which Powershell makes more difficult then it ought to. So please keep in mind that if you are using the AWS CLI on bash or cygwin or similar your mileage will vary (especially where it comes to parsing and generating JSON). Our goal is to be able to walk all the way through the certificate issuance process, including validation.
This process includes some changes to DNS so if you are using Route 53 please refer back to our previous article in this series on Scalable Solutions – Amazon Route 53 Basics.
Before we dive in lets talk about why AWS Certificate Manager. The primary reason for ACM is that it allows us to no longer worry about certificate expiration, which is a huge benefit. Now, this is a huge benefit which actually causes a significant downside at the same time. The biggest drawback to ACM is that we can only deploy these certs to AWS controlled resources which are exclusively managed by AWS, such as Elastic Load Balancers, Cloudfront Distributions, and API Gateways. Since they control the infrastructure they can seamlessly issue and replace certificates as needed, thus no expiration headaches.
Requesting a Certificate
Now like any certificate infrastructure you will need to request a certificate. Remember that when you are issuing certs you must account for all domain names that will be used when accessing the site or you will receive browser errors.
$ aws acm request-certificate –domain-name [ domain-name ] –validation-method [ EMAIL | DNS ] –subject-alternative-names [ domain-name1 domain-name2 ] –domain-validation-options DomainName=[ url ],ValidationDomain=[ domain ]
Here we are bringing up a new server named monkey.itfromallangles.com which will require a certificate to serve HTTPS traffic. We don’t have any alternative names, also we have specified some domain-validation-options, these are only necessary for EMAIL based validation methods.
PS> aws acm request-certificate –domain-name monkey.itfromallangles.com –validation-method DNS –domain-validation-options DomainName=monkey.itfromallangles.com,ValidationDomain=itfromallangles.com<br />
{<br />
"CertificateArn": "arn:aws:acm:us-east-1:112233445566:certificate/612c35e2-f8b5-49ac-8f20-246e851c0659"<br />
}
Now pay attention to the certificate arn, this will be needed later.
Describing a Certificate
Now lets take a look at the certificate we created earlier. Notice that the ValidationStatus is PENDING_VALIDATION and the element below that which indicates the ResourceRecord which the validation engine will be checking for. You can manually create this in your DNS zone.
PS> aws acm describe-certificate –certificate-arn arn:aws:acm:us-east-1:112233445566:certificate/612c35e2-f8b5-49ac-8f20-246e851c0659<br />
{<br />
"Certificate": {<br />
"CertificateArn": "arn:aws:acm:us-east-1:112233445566:certificate/612c35e2-f8b5-49ac-8f20-246e851c0659",<br />
"Status": "PENDING_VALIDATION",<br />
"SubjectAlternativeNames": [<br />
"monkey.itfromallangles.com"<br />
],<br />
"DomainName": "monkey.itfromallangles.com",<br />
"InUseBy": [],<br />
"KeyUsages": [],<br />
"DomainValidationOptions": [<br />
{<br />
"ValidationStatus": "PENDING_VALIDATION",<br />
"ResourceRecord": {<br />
"Type": "CNAME",<br />
"Name": "_b10e7b9a64be4d8215455f6d73369fd4.monkey.itfromallangles.com.",<br />
"Value": "_faabe6071c86f5d4357ea668e9b0105b.acm-validations.aws."<br />
},<br />
"ValidationMethod": "DNS",<br />
"DomainName": "monkey.itfromallangles.com"<br />
}<br />
],<br />
"KeyAlgorithm": "RSA-2048",<br />
"SignatureAlgorithm": "SHA256WITHRSA",<br />
"Type": "AMAZON_ISSUED",<br />
"ExtendedKeyUsages": [],<br />
"CreatedAt": 1530283403.0,<br />
"Subject": "CN=monkey.itfromallangles.com"<br />
}<br />
}
Retrieve Validation Record Details from ACM
Here we are going to retrieve the record details for easier creation of the record.
PS> $record = (aws acm describe-certificate –certificate-arn arn:aws:acm:us-east-1:112233445566:certificate/612c35e2-f8b5-49ac-8f20-246e851c0659 | ConvertFrom-Json).Certificate.DomainValidationOptions.ResourceRecord
Lets take a look at what we have.
PS> $record.name<br />
_b10e7b9a64be4d8215455f6d73369fd4.monkey.itfromallangles.com.<br />
PS> $record.value<br />
_faabe6071c86f5d4357ea668e9b0105b.acm-validations.aws.<br />
PS> $record.type<br />
CNAME
We will use these in the next section.
Build Change Set for Validation Record
Here we are going to create a temporary file in your TEMP directory that will create the record you need to see.
PS> @{<br />
Changes = @(<br />
@{<br />
Action = ‘UPSERT'<br />
ResourceRecordSet = @{<br />
Name = $record.Name<br />
Type = $record.Type<br />
TTL = 300<br />
ResourceRecords = @(<br />
@{<br />
Value = $record.Value<br />
}<br />
)<br />
}<br />
})<br />
} | ConvertTo-Json -Depth 5 -Compress | Out-File $env:TEMP\route53change.json -Encoding ASCII
This is really where Powershell does the opposite of shining, the hoops you have to jump through to make this JSON usable is ridiculous.
Create Change Resource Record Sets Request in Route 53
The command below takes the file that we have created and applies it against the hosted zone which matches itfromallangles.com
PS> aws route53 change-resource-record-sets –hosted-zone-id ((aws route53 list-hosted-zones | ConvertFrom-Json)."HostedZones" | where { $_.Name -eq "itfromallangles.com." }).Id –change-batch file://$env:TEMP\route53change.json<br />
{<br />
"ChangeInfo": {<br />
"Status": "PENDING",<br />
"SubmittedAt": "2018-06-29T17:08:12.448Z",<br />
"Id": "/change/C1QOL63X6O24IZ"<br />
}<br />
}
We will need the change id to check the status of the zone update. As we can see above it is PENDING.
Check Change Status
This allows us to check the status of a given changeset.
PS> aws route53 get-change –id C1QOL63X6O24IZ<br />
{<br />
"ChangeInfo": {<br />
"Status": "INSYNC",<br />
"SubmittedAt": "2018-06-29T17:08:12.448Z",<br />
"Id": "/change/C1QOL63X6O24IZ"<br />
}<br />
}
We are looking for it to say INSYNC.
Check Certificate Status
Now that we have DNS updated we can check the certificate’s validation status.
PS> (aws acm describe-certificate –certificate-arn arn:aws:acm:us-east-1:112233445566:certificate/612c35e2-f8b5-49ac-8f20-246e851c0659 | ConvertFrom-Json).Certificate.DomainValidationOptions.ValidationStatus<br />
PENDING_VALIDATION
Not yet, lets give it some more time.
PS> (aws acm describe-certificate –certificate-arn arn:aws:acm:us-east-1:112233445566:certificate/612c35e2-f8b5-49ac-8f20-246e851c0659 | ConvertFrom-Json).Certificate.DomainValidationOptions.ValidationStatus<br />
SUCCESS
SUCCESS that is what we were waiting for, this certificate can now be associated with our resources.
