CDK Certificate Manager fromCertificateArn "The provided certificate does not exist"

[L1qu1d1c3]

• I'm submitting a ...

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?
  I use typescript CDK to create an API gateway LambdaRestApi with a certificate in the domainName. I get the certificate using certmanager.Certificate.fromCertificateArn passing the entire arn, like arn:aws:acm:REGION:ACC_ID:certificate/CERT_ID, but when deploying the stack, I get error: The provided certificate does not exist

• What is the expected behavior (or behavior of feature suggested)?
  To get the certificate using the ARN and inject that to the APIGW provider.

• Please tell us about your environment:

  • CDK CLI Version: 1.3.0 (build bba9914)
  • Module Version: @aws-cdk/aws-certificatemanager 1.3.0
  • OS: [ OSX Mojave 10.14.6 ]
  • Language: [ TypeScript ]

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

Here's a code sample:

var certArn = 'arn:aws:acm:REGION:ACCOUNT:certificate/ID'
const cert = certmanager.Certificate.fromCertificateArn(this, 'SomeCertName', certArn);

// Set up the API and its resources
const apiGW = new apigw.LambdaRestApi(this, 'RestAPIName',
    {
    handler: getTenantsLambdaFn,
    domainName: {
        domainName: 'SOMEDOMAINNAME',
        certificate: cert,
    },
    deployOptions: {
        loggingLevel: apigw.MethodLoggingLevel.INFO,
        dataTraceEnabled: true
    },
    proxy: false
});

[L1qu1d1c3]

Is there any update on this? I'm currently blocked until this issue is resolved. Thanks :)

[jforge]

Is there a workaround? This issue still exists in Version 1.15.0

The region property in DnsValidatedCertificateProps does not have an effect.

const certificateArn = new DnsValidatedCertificate(this, 'SiteCertificate', {
  domainName: siteDomain,
  hostedZone: zone,
  region: 'us-east-1'
}).certificateArn;

...
new CloudFrontWebDistribution(this, 'SiteDistribution', {
  aliasConfiguration: {
    acmCertRef: certificateArn,
    names: [siteDomain],
    sslMethod: SSLMethod.SNI,
    securityPolicy: SecurityPolicyProtocol.TLS_V1_2_2018,
  },
...
 });

[nija-at]

@L1qu1d1c3 & @jforge -

This error is typically raised when the certificate in question has not passed validation as yet. Can you confirm that the certificate that you've imported has been validated?

I was able to write a similar CDK program and confirm that the synthesized template is generated as expected and the certificate ARN is marked against the RegionalCertificateArn attribute of the AWS::ApiGateway::DomainName resource type.

Do you see anything off in the template synthesized from your app?