Add: optional ACM certificate SANs

Author: noxmwalsh

README.md

@@ -213,6 +213,7 @@ the AppConfig Agent is enabled.
 | create_endpoint                         | Create an Application Load Balancer for the service. Required to serve traffic.                                                                                                                                                       | `bool`         | `true`      | no          |
 | create_repository                       | Create an ECR repository to host the container image.                                                                                                                                                                                 | `bool`         | `true`      | no          |
 | create_version_parameter                | Create an SSM parameter to store the active version for the image tag.                                                                                                                                                                | `bool`         | `false`     | no          |
+| certificate_sans                        | Additional ACM subject alternative names such as `["*.example.org"]` for hostnames beyond the primary FQDN. Duplicates of the primary name are ignored.                                                                               | `list(string)` | `[]`        | no          |
 | cpu                                     | CPU unit for this task.                                                                                                                                                                                                               | `number`       | `512`       | no          |
 | desired_containers                      | Desired number of running containers for the service.                                                                                                                                                                                 | `number`       | `1`         | no          |
 | [enable_appconfig_agent]                | Enable an AWS AppConfig Agent sidecar container for live configuration updates.                                                                                                                                                       | `bool`         | `false`     | no          |

alb.tf

@@ -74,8 +74,9 @@ module "alb" {
 resource "aws_acm_certificate" "endpoint" {
   for_each = var.create_endpoint ? toset(["this"]) : toset([])
 
-  domain_name       = local.fqdn
-  validation_method = "DNS"
+  domain_name               = local.fqdn
+  subject_alternative_names = local.certificate_sans
+  validation_method         = "DNS"
 
   lifecycle {
     create_before_destroy = true

local.tf

@@ -1,5 +1,9 @@
 locals {
   fqdn = var.subdomain != "" ? "${var.subdomain}.${var.domain}" : var.domain
+  # Drop SANs that duplicate the primary certificate name; ACM rejects that.
+  certificate_sans = [
+    for name in var.certificate_sans : name if name != local.fqdn
+  ]
   hosted_zone_id = (!var.create_endpoint
     ? null
     : (var.hosted_zone_id == null ? data.aws_route53_zone.domain["this"].zone_id : var.hosted_zone_id)

variables.tf

@@ -50,6 +50,18 @@ variable "container_port" {
   default     = 80
 }
 
+variable "certificate_sans" {
+  type        = list(string)
+  description = <<-EOT
+    Additional subject alternative names for the ACM certificate. Use this for
+    wildcard names such as `*.example.org` when the ALB must terminate TLS for
+    hostnames beyond the primary `subdomain.domain` FQDN. Names that match the
+    primary FQDN are ignored. Existing DNS validation records cover SANs
+    automatically.
+    EOT
+  default     = []
+}
+
 variable "create_endpoint" {
   type        = bool
   description = "Create an Application Load Balancer for the service."