fix: create single route53 validation record for acm certificate

Update root module outputs with ACM outputs. Fix tests.

Author: saumitra-dev

modules/acm/main.tf

@@ -1,3 +1,12 @@
+locals {
+  acm_certificate_domain_validation_option = tolist(aws_acm_certificate.this.domain_validation_options)[0]
+  acm_certificate_validation_record = {
+    name  = local.acm_certificate_domain_validation_option.resource_record_name
+    type  = local.acm_certificate_domain_validation_option.resource_record_type
+    value = local.acm_certificate_domain_validation_option.resource_record_value
+  }
+}
+
 ################################################################################
 # ACM Certificate
 ################################################################################
@@ -29,23 +38,15 @@ resource "aws_acm_certificate" "this" {
 ################################################################################
 
 resource "aws_route53_record" "this" {
-  for_each = {
-    for record in aws_acm_certificate.this.domain_validation_options : record.domain_name => {
-      name  = record.resource_record_name
-      type  = record.resource_record_type
-      value = record.resource_record_value
-    }
-  }
-
   zone_id         = var.record_zone_id
-  name            = each.value.name
-  type            = each.value.type
-  records         = [each.value.value]
+  name            = local.acm_certificate_validation_record.name
+  type            = local.acm_certificate_validation_record.type
+  records         = [local.acm_certificate_validation_record.value]
   ttl             = 60
   allow_overwrite = var.record_allow_overwrite
 }
 
 resource "aws_acm_certificate_validation" "this" {
   certificate_arn         = aws_acm_certificate.this.arn
-  validation_record_fqdns = [for route53_record in aws_route53_record.this : route53_record.fqdn]
+  validation_record_fqdns = [aws_route53_record.this.fqdn]
 }

modules/acm/outputs.tf

@@ -16,9 +16,9 @@ output "acm_certificate_arn" {
 # Route53 Record
 ################################################################################
 
-output "route53_records_ids" {
-  description = "Identifiers of the Validation Records of the ACM certificate."
-  value       = [for record in aws_route53_record.this : record.id]
+output "route53_record_id" {
+  description = "Identifier of the Route53 Record for validation of the ACM certificate."
+  value       = aws_route53_record.this.id
 }
 
 ################################################################################

outputs.tf

@@ -30,6 +30,16 @@ output "acm_certificates_arns" {
   value       = try({ for k, v in module.acm : k => v.acm_certificate_arn }, null)
 }
 
+output "acm_route53_records_ids" {
+  description = "Identifiers of the Route53 Records for validation of the ACM certificates."
+  value       = try({ for k, v in module.acm : k => v.route53_record_id }, null)
+}
+
+output "acm_certificate_validation_id" {
+  description = "Identifiers of the ACM certificates validation resources."
+  value       = try({ for k, v in module.acm : k => v.acm_certificate_validation_id }, null)
+}
+
 ################################################################################
 # Application Load Balancer
 ################################################################################

tests/acm_unit_tests.tftest.hcl

@@ -6,60 +6,58 @@ provider "aws" {
 # ACM
 ################################################################################
 
-run "amazon_issued_certificates_attributes_match" {
+run "acm_certificate_attributes_match" {
   command = plan
 
   module {
     source = "./modules/acm"
   }
 
   variables {
-    amazon_issued_certificates = {
-      example = {
-        domain_name               = "example.domain"
-        subject_alternative_names = ["example_optional_name"]
-        validation_method         = "EMAIL"
-        key_algorithm             = "RSA_4096"
+    certificate_domain_name               = "example.domain"
+    certificate_subject_alternative_names = ["example_optional_name"]
+    certificate_validation_method         = "EMAIL"
+    certificate_key_algorithm             = "RSA_4096"
+
+    certificate_validation_option = {
+      domain_name       = "example.domain"
+      validation_domain = "me@example.domain"
+    }
 
-        validation_option = {
-          domain_name       = "example.domain"
-          validation_domain = "me@example.domain"
-        }
+    record_zone_id = "example_zone_id"
 
-        tags = {
-          Example = "Tag"
-        }
-      }
+    tags = {
+      Example = "Tag"
     }
   }
 
   assert {
-    condition     = aws_acm_certificate.amazon_issued["example"].domain_name == var.amazon_issued_certificates.example.domain_name
+    condition     = aws_acm_certificate.this.domain_name == var.certificate_domain_name
     error_message = "Domain name mismatch"
   }
 
   assert {
-    condition     = aws_acm_certificate.amazon_issued["example"].validation_method == var.amazon_issued_certificates.example.validation_method
+    condition     = aws_acm_certificate.this.validation_method == var.certificate_validation_method
     error_message = "Validation method mismatch"
   }
 
   assert {
-    condition     = aws_acm_certificate.amazon_issued["example"].key_algorithm == var.amazon_issued_certificates.example.key_algorithm
+    condition     = aws_acm_certificate.this.key_algorithm == var.certificate_key_algorithm
     error_message = "Key algorithm mismatch"
   }
 
   assert {
-    condition     = tolist(aws_acm_certificate.amazon_issued["example"].validation_option)[0].domain_name == var.amazon_issued_certificates.example.validation_option.domain_name
+    condition     = tolist(aws_acm_certificate.this.validation_option)[0].domain_name == var.certificate_validation_option.domain_name
     error_message = "Validation option domain name mismatch"
   }
 
   assert {
-    condition     = tolist(aws_acm_certificate.amazon_issued["example"].validation_option)[0].validation_domain == var.amazon_issued_certificates.example.validation_option.validation_domain
+    condition     = tolist(aws_acm_certificate.this.validation_option)[0].validation_domain == var.certificate_validation_option.validation_domain
     error_message = "Validation option validation domain mismatch"
   }
 
   assert {
-    condition     = aws_acm_certificate.amazon_issued["example"].tags == var.amazon_issued_certificates.example.tags
+    condition     = aws_acm_certificate.this.tags == var.tags
     error_message = "Tags mismatch"
   }
 }