-
Notifications
You must be signed in to change notification settings - Fork 154
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Import self-managed certificate to ACM then importing into Pulumi fails #4046
Comments
Interesting: When I run
which was the domain I specified when creating the certificate. |
@pierskarsenbarg do you have an example app we can use to reproduce? When I try to reproduce this, I only get an error if I specify the |
I was importing into a program generated by |
Workarounds for the different ways of importing: Importing using the CLI:
|
Workarounds above, but since when using the CLI command to import the resources it would be nice to actually output code that works straight away so people don't have to search for this issue. We also specify in the docs that changing the It would also be nice to remove the warning from the CLI output as well. |
In my case, the code wasn't generated by the import, I added it myself. The validationMethod is not set and I run into the problem of this issue, using the Go SDK:
|
@blaargh what version of the AWS provider are you using? Using the same self-signed private key and cert files that I generated using the package main
import (
"fmt"
"os"
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/acm"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
privateKeyData, err := os.ReadFile("/path/to/private.key")
if err != nil {
return fmt.Errorf("couldn't read private key %v", err)
}
privateKeyString := string(privateKeyData)
certData, err := os.ReadFile("/path/to/certificate.crt")
if err != nil {
return fmt.Errorf("couldn't read cert body %v", err)
}
certString := string(certData)
cert, _ := acm.NewCertificate(ctx, "gocert", &acm.CertificateArgs{
CertificateBody: pulumi.String(certString),
PrivateKey: pulumi.String(privateKeyString),
})
ctx.Export("arn", cert.Arn)
return nil
})
} The only difference being that mine is self-signed and you've got a certificate chain. |
I just updated to 6.39.0 (latest version). I get the same error, this is the diff output:
The code I pasted before is the exact one I use, where I don't set the validationMethod at all. |
Are you using the import command? So If you are, you don't need any code in there to start with as the CLI generates the code for you to copy and paste in. If you are just seeing the warning and the code appear in the CLI output, then the certificate has been imported. You can then copy and paste the code (without the |
Damn, okay this is my bad. I never executed the import (by choosing 'yes') because I didn't want to risk anything when the warnings are present. Just executing the command works without any issues... I am importing everything based on the code I already have |
That's ok, that's why I wanted this issue left open so we can do something to remove the warning |
@corymhall given our conversation yesterday, and that this works with the workaround of "removing the |
@pierskarsenbarg yes I think creating a new ticket makes sense. |
Created #4054 as the fix issue. Closing this one in the meantime as the workaround is documented above. |
Describe what happened
When you import a certificate into ACM, the validationMethod is set to "NONE". When running
pulumi import
against this resource, you get the following warning message:You can still continue import it but if you run
pulumi up
afterwards, it fails with an error with the same wanting message as above.And you can't change the
validationMethod
to anything because that triggers a replacement.In our docs, we specify this alongside the
validationMethod
input:Sample program
Create certificate and import into ACM
(requires
openssl
installed)openssl genrsa -out private.key 2048
openssl req -new -x509 -nodes -sha1 -days 365 -extensions v3_ca -key private.key -out certificate.crt
and answer questionsaws acm import-certificate --certificate fileb://certificate.crt --private-key fileb://private.key --region {region}
Import into Pulumi
pulumi import aws:acm/certificate:Certificate my-cert arn:aws:acm:eu-west-1:123456789:certificate/{guid-from-arn}
Log output
Gist here: https://gist.github.com/pierskarsenbarg/c82c19d06e66120cab36d5d276c25566
Affected Resource(s)
No response
Output of
pulumi about
Additional context
Looks like it's been possible to import using the upstream provider for a while: hashicorp/terraform-provider-aws#31425
Contributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
The text was updated successfully, but these errors were encountered: