aws_acm_certificate recreated if domain_name is within the subject_alternative_names

[Lapz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Affected Resource(s)

• aws_acm_certificate

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_acm_certificate" "certificate" {
  domain_name               = var.public_dns_name
  subject_alternative_names = [var.public_dns_name]
  validation_method         = "DNS"
  lifecycle {
    create_before_destroy = true
  }
}

Expected Behavior

An aws_acm_certificate should be created with the subject_alternative_names present, currently the domain_name is not added and everytime a terraform apply is ran the resource is recreated.

Actual Behavior

The resource is created without the domain_name present in the alternative subject names

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[mattburgess]

I've run into this too. On looking into fixing the issue it turns out this behaviour is avoidable by simply not specifying the domain name in the subject alternative names list.

If you do this using both the AWS CLI & Terraform, then the certificates do get created with the domain name in the SAN. The slight issue is that this "default SAN" isn't shown in the AWS console at all. However, terraform state show and aws describe-certificate both show the SAN entry is correct.

So, for the time being, I'd propose a simple "documentation fix" for this explaining the behaviour and being explicit that specifying the domain name in the subject_alternative_names argument isn't required as it's added automatically.

[github-actions]

This functionality has been released in v4.12.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.