(@aws-cdk/aws-certificatemanager): certificate SAN's not filtered for validated

[chris-bannister-privitar]

aws-cdk/packages/@aws-cdk/aws-certificatemanager/lib/certificate.ts

Line 281 in 62e2f19

function getUniqueDnsDomainNames(domainNames: string[]) {

does not correctly filter wildcard domains for unresolved token domains, consider the following certificate request

        final Certificate certificate = Builder.create(scope, "public-domain-cert")
                .domainName("acme.com")
                .subjectAlternativeNames(Arrays.asList("*.acme.com", "*.test.acme.com"))
                .validation(CertificateValidation.fromDns(zone))
                .build();

When the domain name is known then this generates the correct certificate request with *.acme.com filtered out of the certificate props.

When the domain name contains a part which is not fully resolved via HostedZone.fromHostedZoneAttributes then the SAN's will not be filtered correctly leading to CloudFormation to apply invalid RecordSet which causes deploy to fail.

        final Certificate certificate = Builder.create(scope, "public-domain-cert")
                .domainName(zone.getZoneName())
                .subjectAlternativeNames(Arrays.asList("*." + zone.getZoneName(), "*.test." + zone.getZoneName()))
                .validation(CertificateValidation.fromDns(zone))
                .build();

This can be fixed by manually filtering the validation props via

        final Certificate certificate = Builder.create(scope, "public-domain-cert")
                .domainName(zone.getZoneName())
                .subjectAlternativeNames(Arrays.asList("*." + zone.getZoneName(), "*.test." + zone.getZoneName()))
                .validation(CertificateValidation.fromDns(zone))
                .build();

        final CfnCertificate cfnCertificate = (CfnCertificate) certificate.getNode().getDefaultChild();
        List<Object> props = new ArrayList<>();
        props.add(DomainValidationOptionProperty.builder().domainName(cfnCertificate.getDomainName()).hostedZoneId(zone.getHostedZoneId()).build());
        for (String san : cfnCertificate.getSubjectAlternativeNames()) {
            if (!san.startsWith("*." + cfnCertificate.getDomainName())) {
                props.add(DomainValidationOptionProperty.builder().domainName(san).hostedZoneId(zone.getHostedZoneId()).build());
            }
        }
        cfnCertificate.setDomainValidationOptions(props);

Reproduction Steps

Create a certificate for a domain in a zone which is imported into the stack with wildcard SAN validation.

            IHostedZone hostedZone = HostedZone.fromHostedZoneAttributes(this, "hosted-zone", HostedZoneAttributes.builder().zoneName(zoneName).hostedZoneId(zoneId).build());

        final Certificate certificate = Builder.create(scope, "public-domain-cert")
                .domainName(zone.getZoneName())
                .subjectAlternativeNames(Arrays.asList("*." + zone.getZoneName(), "*.test." + zone.getZoneName()))
                .validation(CertificateValidation.fromDns(zone))
                .build();

What did you expect to happen?

CDK deploy works

What actually happened?

deploy fails

15/25 |17:19:39 | CREATE_FAILED | AWS::CertificateManager::Certificate | XXXX (YYYYY) [The request contains an invalid set of changes for a resource record set 'CNAME .'] (Service: AmazonRoute53; Status Code: 400; Error Code: InvalidChangeBatch; Request ID: XXXXX; Proxy: null)

Environment

• CDK CLI Version: 1.109.0 (build c647e38)
• Framework Version: 1.109.0 (build c647e38)
• Node.js Version: 14.16.1
• **OS : ** MacOS 11.4
• Language (Version): all

Other

related to #9248

---

This is 🐛 Bug Report

[madeline-k]

@chris-bannister-privitar, thank you for opening this issue and providing a workaround. Since there is a workaround, I am triaging this as a p2 which means that the CDK team will not be able to prioritize fixing this right now.

We always welcome contributions! If you want to try fixing this yourself, please take a look at the contributing guide.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.