AWS Certificate Manager Pipelining

This post will walkthrough automating AWS Certificate Manager validation through a Simple Email Service (SES), S3 and Lambda pipeline.

AWS Certification Manager (ACM) requires verification of the ownership of the domain name, or alternatively, of the super-domain of the domain that you want the certificate for.

Currently the only way this is done is through email to the following addresses,

http://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate. html

The SES pipeline method to simplify AWS certificate manager validation. The Cloudformation template will generate an ACM certificate during creation, which will generate a verification email. By setting up SES on that domain, we can forward the email through S3 to a Lambda remailer and out to our real admins. We can also set it up more simply to go to an SNS topic we can subscribe to.

With a lot of hosted zones we could end up doing extra work to add MX records to everyone of them, luckily, we can use the super-domain instead of the actual domain to do verifications. This means that instead of requiring setting up mail every hosted zone, we can simply set all the sub-domains to verify on the super-domain. For example, mysite.mysubdomain.mydomain.com sets validation domain to mydomain.com, so the verification emails will not be set to admin@mysite.mysubdomain.superdomain.com, but instead to admin@superdomain.com.

See the certificate manager user guide for more information.

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html

The cloudformation for certificate manager allows us to set the validation domain through the DomainValidationOptions key.

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-certificatemanager-certificate-domainvalidationoption.html

To achieve this the most straightforward way would be to set up a mail MX record in route53 for your super-domain pointing at your existing mail service, then, when validating the sub-domain, set the validation domain to the super- domain.

We can set up Amazon Simple Email Service (SES) to work together with ACM. First we setup a route 53 MX record on the super-domain hosted zone to use the Simple Email Service (SES). Add an SES ruleset that sends mail to an S3 bucket and triggers a Lambda function that will forward the email from the bucket. This way the verification email can be sent on to real administrators.

There’s a cloudformation template available for doing this, see https://github.com/niallcreech/cloudformation-seslambdaforwarder.

When creating this stack you can set the email addresses to forward, and a set of forwarding addresses. This cloudformation sets up a lambda function and a S3 bucket with default 3 day deletion policy. We need to setup SES on the domain we want to receive mail on since it doesn’t have cloudformation support, but luckily this is straightforward.