chickens and eggs in AWS S3 CloudFront deployment with Route 53 and ACM

user_421049 0
Viewed 249

I'm automating a deployment of a static site to AWS, including the following:

  1. Uploading static content to an S3 bucket.
  2. Creating a hosted zone in Route 53.
  3. Creating an SSL/TLS certificate in ACM.
  4. Placing the certificate validation records in Route 53.
  5. Creating a CloudFront distribution using the ACM certificate.
  6. Adding Route 53 records to point to the CloudFront distribution.

Everything seems to be automatable, but there's a little snag: at step #5, creating the CloudFront distribution, the certificate has just been created and hasn't been validated yet, so creation of the CloudFront distribution fails. Moreover even waiting for validation won't help, because to be validated the domain's DNS must be updated to point to the name servers for the hosted zone, which aren't known until step #2 when the hosted zone is created.

As I am using a third-party domain registrar, I don't know ahead of time what name pervers to indicate for the domain until completion of step #2. But then step #5 cannot complete until the certificate is validated, which requires updating the name servers with my domain registrar. So I have a chicken-and-egg problem.

Is there any way to tell CloudFound to create the distribution even though the domain is "invalid" (not yet validated), so that after everything is finished I can go update my domain registrar with the name servers for the created hosted zone? Or must I stop this automated process in the middle after creation of the hosted zone, and then come back and complete it later after updating the name servers?

Any other ideas to work around this problem? (Yes, I know I can use Route 53 to register the domain as well, and then probably update the name servers automatically, but I want my automated tool to work with third-party registrars.)

amazon-route53 amazon-cloudfront amazon-web-services amazon-s3
2 Answers
user_47820

I recommend your steps should be:

  1. Create an S3 Bucket

  2. Upload your static content to the bucket.

  3. Create a "placeholder" CloudFront Distribution using bucket from Step 1 (no cert needed; this is your egg)

  4. Create your hosted zone in Route 53.(old step 2)

  5. Create an SSL/TLS certificate in ACM. (old step 3)

  6. Place the certificate validation records in Route 53 (old step 4)

  7. Update your CloudFront Distribution created in step 3 when your cert is done. your chicken!

  8. and on.. remaining automation steps to complete

The minimal requirements for creating a CloudFront web distribution are small. One bucket will do. Go into the console and try for yourself, its simple. Once the distribution is created it can sit idle until your other steps are complete with AWS and your third-party registrar. Then you update the distribution with your fully baked cert. Because this is possible via the console, and all console actions are backed by API calls, means that you can automate this.

Take a look at the create CloudFront API call requirements compared to the update CloudFront API requirements. You can create a distribution without a valid certificate. However for updates to that placeholder distribution, you will need all of the required fields, to include the ViewerCertificate.

Keep in mind when building your automated tool, if you get stuck with the API, try the action in the console to determine/reverse engineer the values needed to pass into the API calls.

user_8190190
Related