ACMCertificate | Praxis resources

Resource definition

What this resource looks like

This is the CUE shape a Praxis template uses to declare a ACMCertificate. The resource key is local to the template; metadata.name supplies its stable Praxis identity.

resources: cert: {
	apiVersion: "praxis.io/alpha"
	kind:       "ACMCertificate"
	metadata: name: "\(variables.name)-\(variables.environment)-cert"
	spec: {
		region:           "us-east-1"
		domainName:       variables.domainName
		validationMethod: "DNS"
		keyAlgorithm:     "RSA_2048"
		options: certificateTransparencyLoggingPreference: "ENABLED"
		tags: {
			app: variables.name
			env: variables.environment
		}
	}
}

Excerpted from examples/acm/basic-certificate.cue. Open the complete example for its variables and related resources.

Complete examples in the repository

acm basic certificate acm https stack acm wildcard certificate stacks end to end stacks saas platform

Desired state

Configuration

The spec block accepts 9 fields. 3 are required by the schema; fields with defaults can be omitted.

accountOptional

Account.

string

String

regionRequired

Region.

string

String

domainNameRequired

Domain Name.

string & =~"^(\\*\\.)?(([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)+[A-Za-z]{2,})$"

String

subjectAlternativeNamesOptional

Subject Alternative Names.

[...string & =~"^(\\*\\.)?(([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)+[A-Za-z]{2,})$"]

Object list

validationMethodOptional

Validation Method.

"DNS" | "EMAIL" | *"DNS"

EnumDefault "DNS"

keyAlgorithmOptional

Key Algorithm.

"RSA_1024" | "RSA_2048" | "RSA_3072" | "RSA_4096" | "EC_prime256v1" | "EC_secp384r1" | "EC_secp521r1" | *"RSA_2048"

EnumDefault "RSA_2048"

certificateAuthorityArnOptional

Certificate Authority ARN.

string

String

optionsOptional

Options.

certificateTransparencyLoggingPreference?: "ENABLED" | "DISABLED" | *"ENABLED"

ObjectDefault "ENABLED"

tagsRequired

Tags.

[string]: string

Map

Observed values

Outputs

Praxis records these values after observation. A dependent resource can read one with ${resources.<name>.outputs.<field>}.

certificateArnString

domainNameString

statusString

dnsValidationRecordsObject list · optional

notBeforeString · optional

notAfterString · optional

Read without ownership

Data-source lookup

A data block reads an existing ACMCertificate and exposes its outputs without storing lifecycle state. The generic filter surface accepts id, name, and tag; supported combinations depend on the AWS identity used by this resource.

data: existing: {
  kind: "ACMCertificate"
  region: "us-west-2"
  filter: {
    name: "replace-with-provider-name"
  }
}

Understand data sources and filters →

Adopt existing infrastructure

Import

Import persists Praxis state for an existing AWS resource. For this kind, supply: Provider identifier for the existing ACMCertificate. The example starts in observed mode so Praxis reports drift without correcting it.

praxis import ACMCertificate \
  --id <provider-identifier> \
  --region us-west-2 \
  --account production \
  --observe

Choose managed or observed ownership →

Canonical contract

Complete CUE schema

The field guide above is derived from this definition. The schema remains the source of truth for accepted values, defaults, validation constraints, and outputs in the current alpha revision.

Show the complete schema

package acm

#ACMCertificate: {
	apiVersion: "praxis.io/alpha"
	kind:       "ACMCertificate"

	metadata: {
		name: string & =~"^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$"
		labels: [string]: string
	}

	spec: {
		account?:   string
		region:     string
		domainName: string & =~"^(\\*\\.)?(([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)+[A-Za-z]{2,})$"
		subjectAlternativeNames?: [...string & =~"^(\\*\\.)?(([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\\.)+[A-Za-z]{2,})$"]
		validationMethod?:        "DNS" | "EMAIL" | *"DNS"
		keyAlgorithm?:            "RSA_1024" | "RSA_2048" | "RSA_3072" | "RSA_4096" | "EC_prime256v1" | "EC_secp384r1" | "EC_secp521r1" | *"RSA_2048"
		certificateAuthorityArn?: string
		options?: certificateTransparencyLoggingPreference?: "ENABLED" | "DISABLED" | *"ENABLED"
		tags: [string]:                                      string
	}

	outputs?: {
		certificateArn: string
		domainName:     string
		status:         string
		dnsValidationRecords?: [...{
			domainName:          string
			resourceRecordName:  string
			resourceRecordType:  string
			resourceRecordValue: string
		}]
		notBefore?: string
		notAfter?:  string
	}
}

View this schema on GitHub →