使用TypeScript创建AWS IoT Core的CfnCertificate报错及参数咨询

问题概述 #

使用TypeScript通过AWS CDK创建AWS IoT Core的CfnCertificate资源时，触发「Invalid request provided」错误，提示默认证书模式下必须指定[CertificatePem和CACertificatePem]或[CertificateSigningRequest]其中一组参数。当前代码仅设置了status: 'ACTIVE'，需明确caCertificatePem、certificatePem、certificateSigningRequest的合法值类型及使用方式。

错误信息 #

Failed resources:
IotCoreStack | 1:46:26 a.m. | CREATE_FAILED        | AWS::IoT::Certificate | MyCfnCertificate1 Resource handler returned message: "Invalid request provided: For certificate mode Default, one of the following combinations must be specified exactly: [CertificatePem and CACertificatePem] OR [CertificateSigningRequest]" (RequestToken: dc01e655-f0ba-5593-8983-f16973de7236, HandlerErrorCode: InvalidRequest)

 ❌  IotCoreStack failed: Error: The stack named IotCoreStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: For certificate mode Default, one of the following combinations must be specified exactly: [CertificatePem and CACertificatePem] OR [CertificateSigningRequest]" (RequestToken: dc01e655-f0ba-5593-8983-f16973de7236, HandlerErrorCode: InvalidRequest)
    at prepareAndExecuteChangeSet (C:\Users\makad\AppData\Roaming\npm\node_modules\aws-cdk\lib\api\deploy-stack.ts:386:13)     
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at CdkToolkit.deploy (C:\Users\makad\AppData\Roaming\npm\node_modules\aws-cdk\lib\cdk-toolkit.ts:219:24)
    at initCommandLine (C:\Users\makad\AppData\Roaming\npm\node_modules\aws-cdk\lib\cli.ts:347:12)

The stack named IotCoreStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: For certificate mode Default, one of the following combinations must be specified exactly: [CertificatePem and CACertificatePem] OR [CertificateSigningRequest]" (RequestToken: dc01e655-f0ba-5593-8983-f16973de7236, HandlerErrorCode: InvalidRequest)

当前代码 #

export class IotCoreStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const cfnCertificate = new iot.CfnCertificate(this, 'MyCfnCertificate1', {
      status: 'ACTIVE',
    });

  }
}

可选参数说明 #

// 以下为可选属性
caCertificatePem: 'caCertificatePem', // CA证书PEM格式内容
certificateMode: 'certificateMode', // 证书模式，默认值为Default
certificatePem: 'certificatePem', // 设备证书PEM格式内容
certificateSigningRequest: 'certificateSigningRequest', // 证书签名请求（CSR）内容

参数合法值类型及使用示例 #

根据错误提示，需二选一提供以下参数组合：

组合1：使用已生成的证书和CA证书 #

• caCertificatePem：字符串类型，必须是完整的CA证书PEM格式内容，包含-----BEGIN CERTIFICATE-----头部和-----END CERTIFICATE-----尾部，中间为证书的Base64编码内容
• certificatePem：字符串类型，必须是完整的设备证书PEM格式内容，同样包含标准的PEM头尾

示例代码：

const cfnCertificate = new iot.CfnCertificate(this, 'MyCfnCertificate1', {
  status: 'ACTIVE',
  caCertificatePem: '-----BEGIN CERTIFICATE-----\nMIICqDCCAZACCQCW5Qr0o0sFZjANBgkqhkiG9w0BAQsFADCBlDCCAUwGCSqGSIb3\nDQEJARYYQWRtaW5pc3RyYXRvcjE5OTA1MDNAZ21haWwuY29tMQswCQYDVQQGEwJV\nUzELMAkGA1UECAwCTlkxCzAJBgNVBAcMAlVUMQswCQYDVQQKDAJTRTEKMAgGA1UE\nCwwBRVMxCzAJBgNVBAMMAkNBMB4XDTE5MDUwMzE4MTQ1N1oXDTIwMDUwMjE4MTQ1\nN1owgYQxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJOWTEOMAwGA1UEBxMFVVMxDjAM\nBgNVBAoTBU5BTUUxEDAOBgNVBAsTB05BTUUgRzEUMBIGA1UEAxMLY2EubmFtZS5v\ncmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMa2W5nG4q6F6a9Xf+U8z7Qj\n...（省略中间内容）...\n-----END CERTIFICATE-----',
  certificatePem: '-----BEGIN CERTIFICATE-----\nMIICqDCCAZACCQCW5Qr0o0sFZjANBgkqhkiG9w0BAQsFADCBlDCCAUwGCSqGSIb3\nDQEJARYYQWRtaW5pc3RyYXRvcjE5OTA1MDNAZ21haWwuY29tMQswCQYDVQQGEwJV\nUzELMAkGA1UECAwCTlkxCzAJBgNVBAcMAlVUMQswCQYDVQQKDAJTRTEKMAgGA1UE\nCwwBRVMxCzAJBgNVBAMMAkNBMB4XDTE5MDUwMzE4MTQ1N1oXDTIwMDUwMjE4MTQ1\nN1owgYQxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJOWTEOMAwGA1UEBxMFVVMxDjAM\nBgNVBAoTBU5BTUUxEDAOBgNVBAsTB05BTUUgRzEUMBIGA1UEAxMLY2EubmFtZS5v\ncmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMa2W5nG4q6F6a9Xf+U8z7Qj\n...（省略中间内容）...\n-----END CERTIFICATE-----'
});

组合2：使用证书签名请求（CSR） #

• certificateSigningRequest：字符串类型，必须是完整的PKCS#10格式CSR内容，包含-----BEGIN CERTIFICATE REQUEST-----头部和-----END CERTIFICATE REQUEST-----尾部，中间为CSR的Base64编码内容

示例代码：

const cfnCertificate = new iot.CfnCertificate(this, 'MyCfnCertificate1', {
  status: 'ACTIVE',
  certificateSigningRequest: '-----BEGIN CERTIFICATE REQUEST-----\nMIICqDCCAZACCQCW5Qr0o0sFZjANBgkqhkiG9w0BAQsFADCBlDCCAUwGCSqGSIb3\nDQEJARYYQWRtaW5pc3RyYXRvcjE5OTA1MDNAZ21haWwuY29tMQswCQYDVQQGEwJV\nUzELMAkGA1UECAwCTlkxCzAJBgNVBAcMAlVUMQswCQYDVQQKDAJTRTEKMAgGA1UE\nCwwBRVMxCzAJBgNVBAMMAkNBMB4XDTE5MDUwMzE4MTQ1N1oXDTIwMDUwMjE4MTQ1\nN1owgYQxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJOWTEOMAwGA1UEBxMFVVMxDjAM\nBgNVBAoTBU5BTUUxEDAOBgNVBAsTB05BTUUgRzEUMBIGA1UEAxMLY2EubmFtZS5v\ncmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMa2W5nG4q6F6a9Xf+U8z7Qj\n...（省略中间内容）...\n-----END CERTIFICATE REQUEST-----'
});

关键注意事项 #

• 两种参数组合只能选一种，不能同时提供
• 测试场景下，可以用OpenSSL工具生成临时的CA证书、设备证书或CSR来填充参数
• 生产环境禁止硬编码证书内容，建议通过AWS Secrets Manager或Systems Manager参数存储来安全引用

内容的提问来源于stack exchange，提问作者Dhrumil Makadia