Terraform部署AWS PCA与ACM证书失败，需手动安装CA证书求助

团队各位：
我正在尝试创建用于IAM Roles Anywhere的AWS PCA（私有证书颁发机构），安装CA证书并通过ACM申请私有证书，但遇到了报错。手动为AWS私有证书颁发机构安装CA证书后，aws_acm_certificate.request_cert可正常创建证书。

版本信息 #

Terraform v1.3.2
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v5.0.1

代码 #

resource "aws_acmpca_certificate_authority" "private_ca_authority" {
  permanent_deletion_time_in_days = 7
  type                            = "ROOT"
  certificate_authority_configuration {
    key_algorithm     = local.key_algorithm
    signing_algorithm = local.signing_algorithm
    subject {
      common_name  = local.common_name
      organization = local.org
    }
  }
  tags = local.tags
}

resource "aws_acmpca_permission" "private_ca_permission" {
  certificate_authority_arn = aws_acmpca_certificate_authority.private_ca_authority.arn
  actions                   = ["IssueCertificate", "GetCertificate", "ListPermissions"]
  principal                 = "acm.amazonaws.com"
}

data "aws_partition" "current" {}

resource "aws_acmpca_certificate" "private_ca_cert" {
  certificate_authority_arn   = aws_acmpca_certificate_authority.private_ca_authority.arn
  certificate_signing_request = aws_acmpca_certificate_authority.private_ca_authority.certificate_signing_request
  signing_algorithm           = local.signing_algorithm

  template_arn = "arn:${data.aws_partition.current.partition}:acm-pca:::template/RootCACertificate/V1"

  validity {
    type  = "YEARS"
    value = local.private_cert_validity
  }
}

resource "aws_acmpca_certificate_authority_certificate" "pca_authority_cert" {
  certificate_authority_arn = aws_acmpca_certificate_authority.private_ca_authority.arn
  certificate               = aws_acmpca_certificate.private_ca_cert.certificate
  certificate_chain         = aws_acmpca_certificate.private_ca_cert.certificate_chain
}

resource "aws_acm_certificate" "request_cert" {
  domain_name               = local.common_name
  certificate_authority_arn = aws_acmpca_certificate_authority.private_ca_authority.arn
  key_algorithm             = local.key_algorithm

  tags = local.tags

  lifecycle {
    create_before_destroy = true
  }

}

报错信息 #

resource "aws_acm_certificate" "request_cert" {
    arn                       = "arn:aws:acm:us-east-1:<>:certificate/ac0c10e9-a84d-4172-b0f9-cf165402cd1e"
    certificate_authority_arn = "arn:aws:acm-pca:us-east-1:<>:certificate-authority/9b42320f-1fb8-45be-98cc-f4d784b95108"
    domain_name               = "domain"
    domain_validation_options = []
    id                        = "arn:aws:acm:us-east-1:<>:certificate/ac0c10e9-a84d-4172-b0f9-cf165402cd1e"
    key_algorithm             = "RSA_2048"
    pending_renewal           = false
    renewal_eligibility       = "INELIGIBLE"
    renewal_summary           = []
    status                    = "FAILED"
    subject_alternative_names = [
        "domain",
    ]

UI报错 #

请问我遗漏了什么配置？

核心问题在于ACM证书请求的时机早于PCA完成激活：Terraform默认仅根据资源引用推断依赖，aws_acm_certificate只引用了aws_acmpca_certificate_authority的ARN，没有关联到完成CA证书安装的aws_acmpca_certificate_authority_certificate资源，导致PCA还处于未激活状态时，ACM就发起了证书请求。

解决步骤 #

在aws_acm_certificate.request_cert中添加显式依赖，确保等待PCA完成证书安装激活后再请求ACM证书：

resource "aws_acm_certificate" "request_cert" {
  domain_name               = local.common_name
  certificate_authority_arn = aws_acmpca_certificate_authority.private_ca_authority.arn
  key_algorithm             = local.key_algorithm

  tags = local.tags

  lifecycle {
    create_before_destroy = true
  }

  # 强制等待PCA完成证书安装
  depends_on = [aws_acmpca_certificate_authority_certificate.pca_authority_cert]
}

验证逻辑 #

手动操作时你先完成了PCA的CA证书安装（对应Terraform中的pca_authority_cert资源），再申请ACM证书，这个顺序是正确的。添加depends_on后，Terraform会严格遵循这个顺序执行，和手动操作逻辑一致，就能避免报错。

内容的提问来源于stack exchange，提问作者Gowthamakanthan Gopal