mjeffryes
commented
8 months ago Thanks for reporting this @dan-cooke, do you happen to have the exact text of the error message you received?
Closed dan-cooke closed 6 months ago
mjeffryes
commented
8 months ago Thanks for reporting this @dan-cooke, do you happen to have the exact text of the error message you received?
dan-cooke
commented
8 months ago @mjeffryes wow I swore I put the error text in 😅 let me see if I can reproduce it
but from memory the error text is basically the issue title
flostadler
commented
6 months ago Hey @dan-cooke, yes the title has the correct error message.
Is the certificate in the ISSUED state?
If not can you try adding an explicit dependency on the certificate validation to the ALB please? Like so:
const apiLoadBalancer = new awsx.lb.ApplicationLoadBalancer('templi-lb', {/*...*/}, { dependsOn: [certValidation] });I'm also gonna try and reproduce this on our end in the meantime
flostadler
commented
6 months ago I'm not able to reproduce the issue locally (pulumi 3.113.1, awsx 2.9.0, aws 6.34.0). This here deploys successfully:
import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";
const vpc = new awsx.ec2.Vpc("florian-test-vpc");
const parentDomain = "REPLACE_WITH_PARENT_DOMAIN";
const parentZone = aws.route53
.getZone({
name: parentDomain,
})
.then((zone) => {
return zone.zoneId;
});
const subdomain = `florian.${parentDomain}`;
const subZone = new aws.route53.Zone(subdomain, {
name: subdomain,
})
new aws.route53.Record(`${subdomain}.NS`, {
name: subdomain,
zoneId: parentZone,
ttl: 30,
type: 'NS',
records: subZone.nameServers,
allowOverwrite: true,
});
const cert = new aws.acm.Certificate('api-cert', {
domainName: subdomain,
validationMethod: 'DNS',
});
const certRecord = new aws.route53.Record('api-cert-validation-record', {
name: cert.domainValidationOptions[0].resourceRecordName,
records: [cert.domainValidationOptions[0].resourceRecordValue],
ttl: 60,
type: cert.domainValidationOptions[0].resourceRecordType,
zoneId: subZone.zoneId,
});
const certValidation = new aws.acm.CertificateValidation(
'api-cert-validation',
{
certificateArn: cert.arn,
validationRecordFqdns: [certRecord.fqdn],
}
);
const apiLoadBalancer = new awsx.lb.ApplicationLoadBalancer('api-lb', {
subnetIds: vpc.publicSubnetIds,
defaultTargetGroup: {
protocol: 'HTTP',
port: 80,
targetType: 'ip',
vpcId: vpc.vpcId,
healthCheck: {
path: '/health',
port: '80',
protocol: 'HTTP',
},
},
listener: {
port: 443,
protocol: 'HTTPS',
sslPolicy: 'ELBSecurityPolicy-TLS13-1-2-2021-06',
certificateArn: cert.arn,
},
});I also tried forcing the certificate to stay in Pending validation state, but that gives me a different error:
UnsupportedCertificate: The certificate 'REDACTED' must have a fully-qualified domain name, a supported signature, and a supported key size..
The only way I was able to replicate the same error message is by passing undefined for the certificateArn property of the listener.
@dan-cooke What versions of awsx/aws are you using? Can you try reproducing this with the latest versions and also check if the certificate gets created correctly?
mjeffryes
commented
6 months ago @dan-cooke if you're still seeing this error can you give us more details to reproduce? or should we close it?
dan-cooke
commented
6 months ago @mjeffryes thanks for looking into this! After I tore everything down again and up a few times the issue just stopped happening. I’m not entirely sure what caused it- I’m 100% sure my cert was in the right region.
but let’s close it for now - I can reopen in future if I encounter it again
What happened?
I have been stuck on this one for a while. When trying to set up a https listener on my ApplicationLoadBalancer I am receiving a validation error saying that I have not attached a certificate
Example
Output of
pulumi aboutAdditional context
No response
Contributing
Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).