ACM
AWS Certificate Manager (ACM) issues TLS certificates, proves you control the domain, and renews them before they expire. Every certificate the platform serves comes from ACM; the web application blueprint requests them, and the AWS Baseline holds the Client VPN server certificate.
What it does
A TLS certificate is what lets a browser trust https://api.prod.company.com. ACM issues public certificates free of charge after DNS validation: it asks for a specific CNAME record in the domain's zone, and issues once it sees the record. Because the record stays in place, ACM renews automatically. A wildcard certificate covers every name one level below a domain. Certificates are regional, with one exception: CloudFront reads certificates only from us-east-1. ACM can also import a certificate issued elsewhere, which does not renew.
How BuiltForProd uses it
Certificates are requested where they are used, in the web application blueprint, one set per stage:
| Unit | Certificate | Region | Used by |
|---|---|---|---|
acm-certificate | <stage>.company.com with a wildcard subject alternative name | The stage's region | The internet-facing API load balancer |
acm-certificate (create_cloudfront_cert = true) | The same names | us-east-1 | The CloudFront distribution serving the frontend |
acm-certificate-internal | Wildcard for internal.company.com hostnames | The stage's region | The internal load balancer in front of ArgoCD |
The zones live in core-dns and core-network, not in the workload account, so modules/acm-certificate writes its validation records through an aliased provider that assumes acme-route53-cross-account in the zone owner's account. The zone id is looked up by domain name, so nothing is hard-coded. Once issued, the certificate ARNs are published to Parameter Store at /acme/usw2/<stage>/acm/certificate_arn, a CloudFront variant and internal_certificate_arn. The application chart leaves ingress.certificateArn empty; the AWS Load Balancer Controller discovers the certificate by the Ingress host name. The internal certificate is passed by ARN instead: the argocd unit reads it from the internal certificate unit and annotates ArgoCD's Ingress with it.
The rest of the TLS posture follows from these certificates: the API load balancer listens on HTTPS 443 only; CloudFront uses the TLSv1.2_2021 policy with an HTTPS redirect.
The AWS Baseline uses ACM once, differently. The Client VPN endpoint needs a server certificate, generated with Easy-RSA and imported into ACM in core-network; the client-vpn unit references it by ARN. Imported certificates are not renewed by ACM.
Terms you will see
| Term | Meaning |
|---|---|
| DNS validation | Proving domain control by publishing a CNAME record ACM asks for. |
| Subject alternative name (SAN) | An extra name a certificate covers; the wildcard is a SAN here. |
| Wildcard | A name such as *.dev.company.com that matches any single label. |
| Managed renewal | ACM re-issuing a validated certificate before expiry, automatically. |
| Imported certificate | A certificate issued outside ACM and uploaded; the VPN server certificate. |
us-east-1 certificate | The copy CloudFront requires, whatever region the stage runs in. |
Where to read more
- Web App Blueprint overview for the load balancers and CDN these certificates serve.
- Route 53 for the zones validation records are written to.
- CloudFront for the distribution that needs the
us-east-1copy.