# acm

Requests ACM certificates with automatic DNS validation via Route 53.

Provisions ACM certificates for one or more domains, creates Route 53 CNAME validation records in the specified hosted zone, and optionally blocks until certificates reach the ISSUED state. For CloudFront certificates, apply this module in `us-east-1` using a provider alias. EMAIL validation is supported but requires manual action.

## Usage

```hcl
module "acm" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/acm/aws"
  version = "0.1.0"

  certificates = {
    api = {
      domain_name  = "api.example.com"
      zone_name    = "example.com"
      subject_alternative_names = ["*.api.example.com"]
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_acm_certificate.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |
| [aws_acm_certificate_validation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate_validation) | resource |
| [aws_route53_record.validation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_certificates"></a> [certificates](#input_certificates) | Map of certificates to request. validation_method must be DNS or EMAIL.<br/>subject_alternative_names is an optional list of additional FQDNs.<br/>zone_name is required for DNS validation — it is looked up via a data source. | <pre>map(object({<br/>    domain_name               = string<br/>    validation_method         = optional(string, "DNS")<br/>    subject_alternative_names = optional(list(string), [])<br/>    zone_name                 = optional(string, null)<br/>    key_algorithm             = optional(string, "RSA_2048")<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |
| <a name="input_wait_for_validation"></a> [wait_for_validation](#input_wait_for_validation) | Block until all DNS-validated certificates are issued | `bool` | `true` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_certificate_arns"></a> [certificate_arns](#output_certificate_arns) | Map of logical certificate key to ARN |
| <a name="output_certificate_domain_names"></a> [certificate_domain_names](#output_certificate_domain_names) | Map of logical certificate key to primary domain name |
| <a name="output_certificate_statuses"></a> [certificate_statuses](#output_certificate_statuses) | Map of logical certificate key to validation status |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->