Terraform中aws_acm_certificate_validation资源报错排查求助

问题背景 #

尝试通过DNS方式生成并验证AWS ACM证书，前序配置步骤均正常，但使用aws_acm_certificate_validation资源时出现找不到证书的报错。

Terraform代码 #

# Create Certificate
resource "aws_acm_certificate" "ic_cert" {
    provider = aws.us-east-1
    domain_name = aws_s3_bucket.ic_bucket_main.bucket
    subject_alternative_names = [aws_s3_bucket.ic_bucket_redirect.bucket]
    validation_method = "DNS"

  tags = {
    Billing = "company X"
  }

  lifecycle {
    create_before_destroy = true
  }
}

# Validate Certificate via DNS
# get zone_id

data "aws_route53_zone" "selected" {
    provider = aws.us-east-1
    name = aws_s3_bucket.ic_bucket_main.bucket
}

# Generate DNS Records
resource "aws_route53_record" "ic_DNS_validation" {
    provider = aws.us-east-1
    for_each = {
        for dvo in aws_acm_certificate.ic_cert.domain_validation_options : dvo.domain_name => {
            name    = dvo.resource_record_name
            record = dvo.resource_record_value
            type    = dvo.resource_record_type
            zone_id = data.aws_route53_zone.selected.zone_id
        }
    }
    allow_overwrite = true
    name = each.value.name
    records = [each.value.record]
    ttl = 60
    type = each.value.type
    zone_id = each.value.zone_id
}

# Confirm certificate creation 
resource "aws_acm_certificate_validation" "ic_cert_validation" {
  certificate_arn         = aws_acm_certificate.ic_cert.arn
  #validation_record_fqdns = [for record in aws_route53_record.ic_DNS_validation : record.fqdn]
  #validation_record_fqdns = [aws_route53_record.ic_DNS_validation.fqdn]
  validation_record_fqdns = [for record in aws_route53_record.ic_DNS_validation : record.fqdn]
}

报错信息 #

Error: reading ACM Certificate (arn:aws:acm:us-east-1:xxxxxxxxxxxxxxxxxxxxx8:certificate/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx): couldn't find resource
 
│   with aws_acm_certificate_validation.ic_cert_validation,
│   on certificates.tf line 45, in resource "aws_acm_certificate_validation" "ic_cert_validation":
│   45: resource "aws_acm_certificate_validation" "ic_cert_validation" {

排查与解决 #

1. 为验证资源指定正确的Provider #

你的ACM证书在us-east-1区域创建（已指定provider = aws.us-east-1），但aws_acm_certificate_validation资源未指定区域Provider，导致Terraform使用默认Provider去其他区域查询证书，从而出现"找不到资源"的错误。修改验证资源，添加Provider指定：

resource "aws_acm_certificate_validation" "ic_cert_validation" {
  provider                = aws.us-east-1 # 新增该行，与证书区域一致
  certificate_arn         = aws_acm_certificate.ic_cert.arn
  validation_record_fqdns = [for record in aws_route53_record.ic_DNS_validation : record.fqdn]
}

2. 确认证书实际存在 #

登录AWS控制台，切换到us-east-1区域，进入ACM证书列表，检查报错信息中的ARN对应的证书是否存在。如果证书因域名验证超时、权限不足等原因创建失败，也会触发该错误。

3. 检查Route53托管区匹配性 #

确保data "aws_route53_zone" "selected"获取到的托管区包含你的证书域名（即S3桶对应的域名）。若托管区不匹配，DNS验证记录无法正确生效，可能间接导致证书无法完成创建流程。

4. 排查生命周期配置影响 #

create_before_destroy = true会先创建新证书再销毁旧证书，若旧证书销毁过程中出现异常，可能导致ARN引用混乱。可暂时注释该配置，重新执行terraform apply测试是否解决问题。

内容的提问来源于stack exchange，提问作者FiNaR