Terraform创建CloudFront时出现InvalidViewerCertificate错误怎么办

Error: error updating CloudFront Distribution (EMLDE0O3OG6CZ): InvalidViewerCertificate: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain.

• CloudFront 关联公有ACM证书的强制要求是证书必须托管在*us-east-1（美东弗吉尼亚北部）*区域，该规则由AWS官方限定，不支持修改。
• 当你的Terraform默认AWS Provider绑定的区域不是us-east-1时，data "aws_acm_certificate"默认会从当前Provider指定的区域查询证书，最终拿到的ARN不是us-east-1区域的目标证书，因此触发报错。
• 硬编码证书ARN可正常运行的现象，可直接排除证书本身有效性、CloudFront配置逻辑的问题，问题完全出在ACM数据源的查询区域配置错误。

1. 新增一个指向us-east-1区域的AWS Provider，通过别名和默认Provider做区分：

provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
  # 认证参数（access_key/secret_key/role_arn等）和默认Provider保持一致即可
}

2. 给ACM证书数据源指定使用上述us-east-1区域的Provider，确保从正确区域查询到目标证书：

data "aws_acm_certificate" "issued" {
  provider = aws.us-east-1
  domain   = "*.mydomain.com"
  statuses = ["ISSUED"]
}

3. （可选优化）显式调用证书的arn属性而非id，配置可读性更强，避免属性歧义：

viewer_certificate {
  cloudfront_default_certificate = false
  acm_certificate_arn            = data.aws_acm_certificate.issued.arn
  minimum_protocol_version       = "TLSv1.1_2016"
  ssl_support_method             = "sni-only"
}

修改完成后重新执行terraform plan和terraform apply即可正常创建/更新CloudFront分发。

内容的提问来源于stack exchange，提问作者Mush