Implement aws_acm_certificate flag to query for most recent certificate

aws/data_source_aws_acm_certificate.go

@@ -33,10 +33,33 @@ func dataSourceAwsAcmCertificate() *schema.Resource {
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
+			"most_recent": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
 		},
 	}
 }
 
+type arnData struct {
+	arn       string
+	notBefore *time.Time
+}
+
+func describeCertificate(arn *arnData, conn *acm.ACM) (*acm.DescribeCertificateOutput, error) {
+	params := &acm.DescribeCertificateInput{}
+	params.CertificateArn = &arn.arn
+
+	description, err := conn.DescribeCertificate(params)
+	if err != nil {
+		return nil, err
+	}
+
+	return description, nil
+}
+
 func dataSourceAwsAcmCertificateRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).acmconn
 
@@ -50,38 +73,38 @@ func dataSourceAwsAcmCertificateRead(d *schema.ResourceData, meta interface{}) e
 		params.CertificateStatuses = []*string{aws.String("ISSUED")}
 	}
 
-	var arns []string
+	var arns []*arnData
 	log.Printf("[DEBUG] Reading ACM Certificate: %s", params)
 	err := conn.ListCertificatesPages(params, func(page *acm.ListCertificatesOutput, lastPage bool) bool {
 		for _, cert := range page.CertificateSummaryList {
 			if *cert.DomainName == target {
-				arns = append(arns, *cert.CertificateArn)
+				arns = append(arns, &arnData{*cert.CertificateArn, nil})
 			}
 		}
 
 		return true
 	})
 	if err != nil {
-		return errwrap.Wrapf("Error describing certificates: {{err}}", err)
+		return errwrap.Wrapf("Error listing certificates: {{err}}", err)
 	}
 
 	// filter based on certificate type (imported or aws-issued)
 	types, ok := d.GetOk("types")
 	if ok {
 		typesStrings := expandStringList(types.([]interface{}))
-		var matchedArns []string
+		var matchedArns []*arnData
 		for _, arn := range arns {
-			params := &acm.DescribeCertificateInput{}
-			params.CertificateArn = &arn
-
-			description, err := conn.DescribeCertificate(params)
+			description, err := describeCertificate(arn, conn)
 			if err != nil {
 				return errwrap.Wrapf("Error describing certificates: {{err}}", err)
 			}
 
 			for _, certType := range typesStrings {
 				if *description.Certificate.Type == *certType {
-					matchedArns = append(matchedArns, arn)
+					matchedArns = append(
+						matchedArns,
+						&arnData{arn.arn, description.Certificate.NotBefore},
+					)
 					break
 				}
 			}
@@ -93,12 +116,45 @@ func dataSourceAwsAcmCertificateRead(d *schema.ResourceData, meta interface{}) e
 	if len(arns) == 0 {
 		return fmt.Errorf("No certificate for domain %q found in this region.", target)
 	}
+
 	if len(arns) > 1 {
-		return fmt.Errorf("Multiple certificates for domain %q found in this region.", target)
+		// Get most recent sorting by notBefore date. Notice that createdAt field is only valid
+		// for ACM issued certificates but not for imported ones so in a mixed scenario only
+		// fields extracted from the certificate are valid.
+		_, ok = d.GetOk("most_recent")
+		if ok {
+			mr := arns[0]
+			if mr.notBefore == nil {
+				description, err := describeCertificate(mr, conn)
+				if err != nil {
+					return errwrap.Wrapf("Error describing certificates: {{err}}", err)
+				}
+
+				mr.notBefore = description.Certificate.NotBefore
+			}
+			for _, arn := range arns[1:] {
+				if arn.notBefore == nil {
+					description, err := describeCertificate(arn, conn)
+					if err != nil {
+						return errwrap.Wrapf("Error describing certificates: {{err}}", err)
+					}
+
+					arn.notBefore = description.Certificate.NotBefore
+				}
+
+				if arn.notBefore.After(*mr.notBefore) {
+					mr = arn
+				}
+			}
+
+			arns = []*arnData{mr}
+		} else {
+			return fmt.Errorf("Multiple certificates for domain %q found in this region.", target)
+		}
 	}
 
 	d.SetId(time.Now().UTC().String())
-	d.Set("arn", arns[0])
+	d.Set("arn", arns[0].arn)
 
 	return nil
 }

aws/data_source_aws_acm_certificate_test.go

@@ -28,6 +28,18 @@ func TestAccAwsAcmCertificateDataSource_noMatchReturnsError(t *testing.T) {
 				Config:      testAccCheckAwsAcmCertificateDataSourceConfigWithTypes(domain),
 				ExpectError: regexp.MustCompile(`No certificate for domain`),
 			},
+			{
+				Config:      testAccCheckAwsAcmCertificateDataSourceConfigWithMostRecent(domain),
+				ExpectError: regexp.MustCompile(`No certificate for domain`),
+			},
+			{
+				Config:      testAccCheckAwsAcmCertificateDataSourceConfigWithMostRecentAndStatus(domain),
+				ExpectError: regexp.MustCompile(`No certificate for domain`),
+			},
+			{
+				Config:      testAccCheckAwsAcmCertificateDataSourceConfigWithMostRecentAndTypes(domain),
+				ExpectError: regexp.MustCompile(`No certificate for domain`),
+			},
 		},
 	})
 }
@@ -57,3 +69,32 @@ data "aws_acm_certificate" "test" {
 }
 `, domain)
 }
+
+func testAccCheckAwsAcmCertificateDataSourceConfigWithMostRecent(domain string) string {
+	return fmt.Sprintf(`
+data "aws_acm_certificate" "test" {
+	domain = "%s"
+	most_recent = true
+}
+`, domain)
+}
+
+func testAccCheckAwsAcmCertificateDataSourceConfigWithMostRecentAndStatus(domain string) string {
+	return fmt.Sprintf(`
+data "aws_acm_certificate" "test" {
+	domain = "%s"
+	statuses = ["ISSUED"]
+	most_recent = true
+}
+`, domain)
+}
+
+func testAccCheckAwsAcmCertificateDataSourceConfigWithMostRecentAndTypes(domain string) string {
+	return fmt.Sprintf(`
+data "aws_acm_certificate" "test" {
+	domain = "%s"
+	types = ["IMPORTED"]
+	most_recent = true
+}
+`, domain)
+}

website/docs/d/acm_certificate.html.markdown

@@ -21,6 +21,12 @@ data "aws_acm_certificate" "example" {
   domain   = "tf.example.com"
   statuses = ["ISSUED"]
 }
+
+data "aws_acm_certificate" "example" {
+  domain   = "tf.example.com"
+  types = ["AMAZON_ISSUED"]
+  most_recent = true
+}
 ```
 
 ## Argument Reference
@@ -29,6 +35,8 @@ data "aws_acm_certificate" "example" {
  * `statuses` - (Optional) A list of statuses on which to filter the returned list. Valid values are `PENDING_VALIDATION`, `ISSUED`,
    `INACTIVE`, `EXPIRED`, `VALIDATION_TIMED_OUT`, `REVOKED` and `FAILED`. If no value is specified, only certificates in the `ISSUED` state
    are returned.
+ * `types` - (Optional) A list of types on which to filter the returned list. Valid values are `AMAZON_ISSUED` and `IMPORTED`.
+ * `most_recent` - (Optional) If set to true, it sorts the certificates matched by previous criteria by the NotBefore field, returning only the most recent one. If set to false, it returns an error if more than one certificate is found. Defaults to false.
 
 ## Attributes Reference