How to validate acm certificate created via terraform

Question

I'm trying to create 3 certificates for 3 services named test,valid,jsc and using an exiting hosted zone.But terraform is failing in cert validation stating that certificate is in pending_validation state

variable "service-names" {
  type    = list(any)
  default = ["valid", "jsc", "test"]

}



resource "aws_acm_certificate" "cert" {
  for_each = toset(var.service-names)
  domain_name       = "www.us.${each.value}.xxxxx.cloud"
  validation_method = "DNS"

  tags = {
    Name = "www.us.${each.value}.xxxxx.cloud"
  }

  lifecycle {
    create_before_destroy = true
  }
}



data "aws_route53_zone" "ecomzoneinfo" {
  name         = "xxxxx.cloud"
  tags = {
     "Name" = "www.us.${each.value}.xxxxx.cloud"
   }
}

locals {
  dns-record-list = flatten([
    for svc in var.service-names : [
      for dvo in aws_acm_certificate.cert[svc].domain_validation_options : {
        name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
      service = svc
      }
    ]
  ])
}

resource "aws_route53_record" "ecom-route" {
  for_each = { for idx,dns in local.dns-record-list : "${dns.service}" => dns }
  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.ecomzoneinfo.zone_id
}

resource "aws_acm_certificate_validation" "ecom" {
   for_each = toset(var.service-names)
   certificate_arn         = aws_acm_certificate.cert[each.value].arn
   validation_record_fqdns = [aws_route53_record.ecom-route[each.value].fqdn]
 }

Getting Error stating as certificate is in pending validation and yes i'm able to the certs created by terraform aws_acm_certification resource are in pending status.Even i'm able to see the cname records are added under the zone xxxxx.cloud hosted zone.So i'm not sure what is wrong here

Error: Error describing created certificate: Expected certificate to be issued but was in state PENDING_VALIDATION
│ 
│   with aws_acm_certificate_validation.ecom["jsc"],
│   on main.tf line 449, in resource "aws_acm_certificate_validation" "ecom":
│  449:   resource "aws_acm_certificate_validation" "ecom" {
│ 
╵
╷
│ Error: Error describing created certificate: Expected certificate to be issued but was in state PENDING_VALIDATION
│ 
│   with aws_acm_certificate_validation.ecom["test"],
│   on main.tf line 449, in resource "aws_acm_certificate_validation" "ecom":
│  449:   resource "aws_acm_certificate_validation" "ecom" {
│ 
╵
╷
│ Error: Error describing created certificate: Expected certificate to be issued but was in state PENDING_VALIDATION
│ 
│   with aws_acm_certificate_validation.ecom["valid"],
│   on main.tf line 449, in resource "aws_acm_certificate_validation" "ecom":
│  449:   resource "aws_acm_certificate_validation" "ecom" {

Answer 1

As per the documentation provided.

resource "aws_acm_certificate" "certificate" {
  domain_name = "mydomain.com"
  subject_alternative_names = [
      "*.mydomain.com"
  ]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "acm-records" {
  for_each = {
    for dvo in aws_acm_certificate.certificate.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records = [
    each.value.record
  ]
  ttl     = 60
  type    = each.value.type
  zone_id = aws_route53_zone.mydomain.zone_id
}

resource "aws_acm_certificate_validation" "acm-validation" {
  certificate_arn         = aws_acm_certificate.certificate.arn
  validation_record_fqdns = [for record in aws_route53_record.acm-records : record.fqdn]
}