This message was deleted.
# awss
sparse-intern-71089
10/25/2022, 12:10 AMThis message was deleted.
b
billowy-army-68599
10/25/2022, 12:11 AM
you’ve tried the certificate validation resource?
https://www.pulumi.com/registry/packages/aws/api-docs/acm/certificatevalidation/
l
little-cartoon-10569
10/25/2022, 12:12 AMYes, that's what I'm using, but it takes anywhere from 20 seconds to (in theory) 72 hours. It's never taken more than 30 seconds for me, but that's still enough time to fail the
upn
nice-father-44210
10/25/2022, 1:02 AMWhere is the 30 second time out coming from? I can’t imagine that’s a default.
l
little-cartoon-10569
10/25/2022, 1:27 AMThere's no timeout. When the certificate is created by AWS, it's not ready for use by an LB, but it is a fully-created resource. Pulumi thinks it's good to go. If you use it immediately in an existing LB, AWS will complain, because the AWS async operation to check the cert's validity hasn't completed.
little-cartoon-10569
10/25/2022, 1:28 AMOften you won't notice because you're doing this and creating the LB in the same
uplittle-cartoon-10569
10/25/2022, 1:28 AMRun it again a few seconds later, after the validation completes, it'll work fine.
little-cartoon-10569
10/25/2022, 1:28 AMI was wondering if there was a way to get Pulumi to tell AWS to have the LB try a few times, instead of immediately saying "this certificate isn't ready, error!".
little-cartoon-10569
10/25/2022, 1:29 AMBut I don't think there is... so I just re-ran it.
l
little-soccer-5693
10/25/2022, 3:19 PM@little-cartoon-10569 are you using pulumi.DependsOn() ? in my case I'm using a cert w/ API gateway in the same pulumi up. i had to add:
pulumi.DependsOn([]pulumi.Resource{certValid})
(golang) as an optional argument to gateway2.NewDomainName() where certValid is a CertificateValidation resource.
l
little-cartoon-10569
10/25/2022, 7:46 PMAh, the load balancer might need to be dependent on both the certificate and the CertificateValidation? No I hadn't tried that. I'll make a note to try it later. Thanks!
n
nice-father-44210
10/25/2022, 11:47 PMWhen you reference a resource output (e.g., cert ARN) as an input to another resource (e.g., ALB listener’s certificate), Pulumi implicitly establishes a dependency and waits for the cert to be provisioned before it attempts to create the ALB listener.
Since there are no cert validation resource outputs being references by the ALB listener inputs, the dependency has to be established explicitly via ResourceOptions.
2 Views