demo-stack.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Demo Certificate DNS Record Provider
Parameters:
  HostedZoneId:
    Type: String
    Default: 'Z0371259XDZLRTIQJZIY'
  DomainName:
    Type: String
    Default: 'mark.binx.dev'

Resources:
  Certificate:
    Type: Custom::Certificate
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub '*.${DomainName}'
      ValidationMethod: DNS
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-certificate-provider'

  IssuedCertificate:
    Type: Custom::IssuedCertificate
    DependsOn:
      - DomainValidationRecord
    Properties:
      CertificateArn: !Ref Certificate
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-certificate-provider'

  DomainNameValidationDNSRecord:
    Type: Custom::CertificateDNSRecord
    Properties:
      CertificateArn: !Ref Certificate
      DomainName: !Ref DomainName
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-certificate-provider'

  AlternativeDomainNameValidationDNSRecord:
    Type: Custom::CertificateDNSRecord
    Properties:
      CertificateArn: !Ref Certificate
      DomainName: !Sub '*.${DomainName}'
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-certificate-provider'

  DomainValidationRecord:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId: !Ref HostedZoneId
      RecordSets:
        - Name: !GetAtt DomainNameValidationDNSRecord.Name
          Type: !GetAtt DomainNameValidationDNSRecord.Type
          TTL: 60
          Weight: 1
          SetIdentifier: !Ref Certificate
          ResourceRecords:
            - !GetAtt DomainNameValidationDNSRecord.Value

        - Name: !GetAtt AlternativeDomainNameValidationDNSRecord.Name
          Type: !GetAtt AlternativeDomainNameValidationDNSRecord.Type
          TTL: 60
          Weight: 1
          SetIdentifier: !Ref Certificate
          ResourceRecords:
            - !GetAtt AlternativeDomainNameValidationDNSRecord.Value

Outputs:
  DomainNameValidationDNSRecord:
    Value: !Sub '${DomainNameValidationDNSRecord.Name} ${DomainNameValidationDNSRecord.Type} ${DomainNameValidationDNSRecord.Value}'