I am trying to achieve the following.
First, deploy a CloudFormation stack to region ap-southeast-2 containing:
- An S3 bucket
- A CloudFront distribution using the S3 bucket as origin
- A CNAME in Route53 under a pre-existing HostedZone pointing to the CloudFront distribution
Then, I want to deploy another CloudFormation stack to region us-east-1 with:
- An ACM SSL certificate for the domain (CNAME) registered in point 3, above.
Then, I want the certificate created in point 4, above, to be associated with the CloudFront distribution created in point 2, above, as the Viewer Certificate.
I cannot set the CloudFront Viewer Certificate in the first CloudFormation template because it does not exist yet. It will only exist after the second stack is created.
Is there a way to achieve this with CloudFormation? Is there anything I can do with CloudFormation StackSets to achieve this?
AWS 공식업데이트됨 2년 전
OK, but creating them sequentially is not enough. After CloudFormation creates the second stack with the ACM certificate, it needs to go back to the first stack and assign that new ACM certificate to the CloudFront distribution that was created in that first stack. How does your solution achieve that?
Also, the link you provided takes me back to this very same question in re:Post.
If fixed the link. You will have to run the template in us-east-1 first so you have the cert. You could run it first in ap-southeast-2 and have a condition on whether to setup HTTPS. Then go and create the cert in us-east-1 and then go back and update the stack with the new cert information in ap-southeast-2.
Right, kentrad. But that would be a procedural solution. If I am deploying the templates via CLI, I would have to perform 3 steps:
Even if points 1 and 2 could be performed together as a StackSet, I would still have two separate steps, for it would require me to trigger an update to link the certificate with CloudFront in the end.
I reckon CloudFormation should offer a fully declarative solution for this problem, and the circular dependency should be resolved by AWS.
I think what is missing in your scenario is when you create a certificate, there is currently no way to specify where to install it in CloudFormation for AWS::CertificateManager::Certificate. So, there is no way to create the this circular dependency.