通过CloudFormation创建HostedZone和Certificate遇DNS验证问题

我在通过CloudFormation创建Route53托管区（HostedZone）和ACM证书时遇到以下问题：

• 域名托管在第三方平台，但已将域名的名称服务器指向AWS的名称服务器。
• HostedZone和Certificate能成功创建，但DNS验证环节卡住，验证所需的CNAME记录始终未生成，状态信息显示了验证DNS记录的内容但未实际创建。
• 尝试在DomainValidationOptions中指定HostedZoneId: !Ref HostedZone时，触发Route53的InvalidChangeBatch错误。
• 仅保留主域名时验证可正常完成，但添加泛域名及多级子域名后就出现上述问题。

未指定HostedZoneId的模板 #

Parameters:
  TopLevelDomain:
    Type: String
    Description: The top-level domain to use

Resources:

  HostedZone:
    Type: 'AWS::Route53::HostedZone'
    Properties:
      Name: !Sub '${TopLevelDomain}.'

  Certificate:
    Type: 'AWS::CertificateManager::Certificate'
    DependsOn: HostedZone
    Properties:
      DomainName: !Ref TopLevelDomain
      ValidationMethod: DNS
      SubjectAlternativeNames:
        - !Sub '*.${TopLevelDomain}'
        - !Sub '*.portal.${TopLevelDomain}'
        - !Sub '*.tenant.${TopLevelDomain}'
        - !Sub '*.owner.${TopLevelDomain}'
        - !Sub '*.vendor.${TopLevelDomain}'
      DomainValidationOptions:
        - DomainName: !Ref TopLevelDomain
          ValidationDomain: !Ref TopLevelDomain
        - DomainName: !Sub '*.${TopLevelDomain}'
          ValidationDomain: !Ref TopLevelDomain
        - DomainName: !Sub '*.portal.${TopLevelDomain}'
          ValidationDomain: !Ref TopLevelDomain
        - DomainName: !Sub '*.tenant.${TopLevelDomain}'
          ValidationDomain: !Ref TopLevelDomain
        - DomainName: !Sub '*.owner.${TopLevelDomain}'
          ValidationDomain: !Ref TopLevelDomain
        - DomainName: !Sub '*.vendor.${TopLevelDomain}'
          ValidationDomain: !Ref TopLevelDomain

  MxRecordSet:
    Type: 'AWS::Route53::RecordSet'
    DependsOn: HostedZone
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: !Sub '${TopLevelDomain}.'
      Type: MX
      TTL: '300'
      ResourceRecords:
        - '1 aspmx.l.google.com'
        - '10 aspmx2.googlemail.com'
        - '10 aspmx3.googlemail.com'
        - '5 alt1.aspmx.l.google.com'
        - '5 alt2.aspmx.l.google.com'

Outputs:
  CertificateArn:
    Description: 'The ARN of the certificate'
    Value: !Ref Certificate
    Export:
      Name: CertificateArn

  HostedZoneId:
    Description: 'The ID of the Hosted Zone'
    Value: !Ref HostedZone
    Export:
      Name: HostedZoneId

指定HostedZoneId的模板 #

Parameters:
  TopLevelDomain:
    Type: String
    Description: The top-level domain to use

Resources:

  HostedZone:
    Type: 'AWS::Route53::HostedZone'
    Properties:
      Name: !Sub '${TopLevelDomain}.'

  Certificate:
    Type: 'AWS::CertificateManager::Certificate'
    DependsOn: HostedZone
    Properties:
      DomainName: !Ref TopLevelDomain
      ValidationMethod: DNS
      SubjectAlternativeNames:
        - !Sub '*.${TopLevelDomain}'
        - !Sub '*.portal.${TopLevelDomain}'
        - !Sub '*.tenant.${TopLevelDomain}'
        - !Sub '*.owner.${TopLevelDomain}'
        - !Sub '*.vendor.${TopLevelDomain}'
      DomainValidationOptions:
        - DomainName: !Ref TopLevelDomain
          HostedZoneId: !Ref HostedZone
        - DomainName: !Sub '*.${TopLevelDomain}'
          HostedZoneId: !Ref HostedZone
        - DomainName: !Sub '*.portal.${TopLevelDomain}'
          HostedZoneId: !Ref HostedZone
        - DomainName: !Sub '*.tenant.${TopLevelDomain}'
          HostedZoneId: !Ref HostedZone
        - DomainName: !Sub '*.owner.${TopLevelDomain}'
          HostedZoneId: !Ref HostedZone
        - DomainName: !Sub '*.vendor.${TopLevelDomain}'
          HostedZoneId: !Ref HostedZone

  MxRecordSet:
    Type: 'AWS::Route53::RecordSet'
    DependsOn: HostedZone
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: !Sub '${TopLevelDomain}.'
      Type: MX
      TTL: '300'
      ResourceRecords:
        - '1 aspmx.l.google.com'
        - '10 aspmx2.googlemail.com'
        - '10 aspmx3.googlemail.com'
        - '5 alt1.aspmx.l.google.com'
        - '5 alt2.aspmx.l.google.com'

Outputs:
  CertificateArn:
    Description: 'The ARN of the certificate'
    Value: !Ref Certificate
    Export:
      Name: CertificateArn

  HostedZoneId:
    Description: 'The ID of the Hosted Zone'
    Value: !Ref HostedZone
    Export:
      Name: HostedZoneId

仅保留主域名的正常模板 #

Certificate:
    Type: 'AWS::CertificateManager::Certificate'
    DependsOn: HostedZone
    Properties:
      DomainName: !Ref TopLevelDomain
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: !Ref TopLevelDomain
          HostedZoneId: !Ref HostedZone

内容的提问来源于stack exchange，提问作者Androme