community.aws.aws_acm – Upload and delete certificates in the AWS Certificate Manager service

• Synopsis
• Requirements
• Parameters
• Notes
• Examples
• Return Values

Synopsis

• Import and delete certificates in Amazon Web Service’s Certificate Manager (AWS ACM).
• This module does not currently interact with AWS-provided certificates. It currently only manages certificates provided to AWS by the user.
• The ACM API allows users to upload multiple certificates for the same domain name, and even multiple identical certificates. This module attempts to restrict such freedoms, to be idempotent, as per the Ansible philosophy. It does this through applying AWS resource “Name” tags to ACM certificates.
• When state=present, if there is one certificate in ACM with a Name tag equal to the name_tag parameter, and an identical body and chain, this task will succeed without effect.
• When state=present, if there is one certificate in ACM a Name tag equal to the name_tag parameter, and a different body, this task will overwrite that certificate.
• When state=present, if there are multiple certificates in ACM with a Name tag equal to the name_tag parameter, this task will fail.
• When state=absent and certificate_arn is defined, this module will delete the ACM resource with that ARN if it exists in this region, and succeed without effect if it doesn’t exist.
• When state=absent and domain_name is defined, this module will delete all ACM resources in this AWS region with a corresponding domain name. If there are none, it will succeed without effect.
• When state=absent and certificate_arn is not defined, and domain_name is not defined, this module will delete all ACM resources in this AWS region with a corresponding Name tag. If there are none, it will succeed without effect.
• Note that this may not work properly with keys of size 4096 bits, due to a limitation of the ACM API.

Requirements

The below requirements are needed on the host that executes this module.

• boto
• boto3
• python >= 2.6

Parameters

Notes

Examples

- name: upload a self-signed certificate
  community.aws.aws_acm:
    certificate: "{{ lookup('file', 'cert.pem' ) }}"
    privateKey: "{{ lookup('file', 'key.pem' ) }}"
    name_tag: my_cert # to be applied through an AWS tag as  "Name":"my_cert"
    region: ap-southeast-2 # AWS region

- name: create/update a certificate with a chain
  community.aws.aws_acm:
    certificate: "{{ lookup('file', 'cert.pem' ) }}"
    privateKey: "{{ lookup('file', 'key.pem' ) }}"
    name_tag: my_cert
    certificate_chain: "{{ lookup('file', 'chain.pem' ) }}"
    state: present
    region: ap-southeast-2
  register: cert_create

- name: print ARN of cert we just created
  ansible.builtin.debug:
    var: cert_create.certificate.arn

- name: delete the cert we just created
  community.aws.aws_acm:
    name_tag: my_cert
    state: absent
    region: ap-southeast-2

- name: delete a certificate with a particular ARN
  community.aws.aws_acm:
    certificate_arn: "arn:aws:acm:ap-southeast-2:123456789012:certificate/01234567-abcd-abcd-abcd-012345678901"
    state: absent
    region: ap-southeast-2

- name: delete all certificates with a particular domain name
  community.aws.aws_acm:
    domain_name: acm.ansible.com
    state: absent
    region: ap-southeast-2

Return Values

Common return values are documented here, the following are the fields unique to this module:

Authors

• Matthew Davis (@matt-telstra) on behalf of Telstra Corporation Limited