Terraform AWS ACM module management of SSL TLS certificates using AWS Certificate Manager with Route 53 DNS validation and integration with load balancers CloudFront distributions and APIs is a core operational pattern for infrastructure as code teams. The module creates ACM certificates and validates them using Route53 DNS recommended or e-mail. Certificate management spans public certificates via ACM, Private CA for internal certificates, and Route 53 for DNS validation. Public certificate usage is demonstrated with Application Load Balancer and CloudFront distributing traffic to various compute services ECS, EKS, Elastic Beanstalk. Private certificate usage is demonstrated with internal ALB with private certificates for internal services. User traffic flow is end users accessing applications through CloudFront and ALB with SSL TLS encryption.
The compliance.tf documentation describes Terraform AWS ACM as ACM certificates and validation records for public or private TLS, certificate renewal, and associations used by load balancers, CloudFront distributions, and APIs. Controls enforced are checked at terraform plan time. Migration from upstream is supported for users already using terraform-aws-modules. The source URL can be changed with same arguments and same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions. Reversibility is provided with no lock-in. Switch back by reverting the source URL. Run terraform init -upgrade. Terraform state is unchanged with same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Mapped compliance frameworks show framework coverage which controls from this module are active under each framework endpoint. Control PCI DSS v4.0 coverage is presented in a table.
| Control | PCI DSS v4.0 |
|---|---|
| ACM certificates should not use wildcard certificates | ○ |
| ACM RSA certificates should use a key length of at least 2,048 bits | ● |
| ACM certificates should have transparency logging enabled | ○ |
● enforced by default · ○ not activated by this endpoint
Prerequisites for working with the module include AWS CLI configured with appropriate permissions, Terraform installed version 1.0.0 or later, domain name registered in Route 53 for DNS validation, basic understanding of SSL TLS certificates.
Module Overview and Purpose
The module is described as Terraform module which creates ACM certificates and validates them using Route53 DNS recommended or e-mail. The architecture diagram above shows Certificate Management, Public Certificate Usage, Private Certificate Usage, User Traffic Flow.
The quick start guidance is provided for migration from upstream. Already using terraform-aws-modules, change only the source URL. Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.
Reversibility is emphasized. No lock-in. Switch back by reverting the source URL. Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Project Structure and Configuration Layout
A typical project structure is documented.
terraform-acm/
├── main.tf
├── variables.tf
├── outputs.tf
├── modules/
│ └── acm/
│ ├── main.tf
│ ├── variables.tf
│ └── outputs.tf
└── config/
└── domains.json
The ACM Configuration example creates modules/acm/main.tf with a public certificate resource definition.
resource "aws_acm_certificate" "main" {
domain_name = var.domain_name
validation_method = "DNS"
subject_alternative_names = var.subject_alternative_names
options {
certificate_transparency_logging_preference = "ENABLED"
}
lifecycle {
create_before_destroy = true
}
tags = merge(
var.tags,
{
Name = var.domain_name
}
)
}
This configuration sets domainname, validationmethod to DNS, subjectalternativenames, certificatetransparencyloggingpreference to ENABLED, lifecycle createbeforedestroy true, and merges tags with Name set to var.domainname.
Module Usage Examples
The module is used with source terraform-aws-modules/acm/aws and version ~> 4.0.
module "acm" {
source = "terraform-aws-modules/acm/aws"
version = "~> 4.0"
domain_name = "my-domain.com"
zone_id = "Z2ES7B9AZ6SHAE"
validation_method = "DNS"
subject_alternative_names = [
"*.my-domain.com",
"app.sub.my-domain.com",
]
wait_for_validation = true
tags = {
Name = "my-domain.com"
}
}
A second example uses a different domain.
module "acm" {
source = "terraform-aws-modules/acm/aws"
version = "~> 4.0"
domain_name = "weekly.tf"
zone_id = "b7d259641bf30b89887c943ffc9d2138"
validation_method = "DNS"
subject_alternative_names = [
"*.weekly.tf",
]
create_route53_records = false
validation_record_fqdns = [
"_689571ee9a5f9ec307c512c5d851e25a.weekly.tf",
]
tags = {
Name = "weekly.tf"
}
}
CloudFront supports US East N Virginia Region only.
Provider configuration for region specific ACM usage is shown.
provider "aws" {
alias = "us-east-1"
region = "us-east-1"
}
module "acm" {
source = "terraform-aws-modules/acm/aws"
providers = {
aws = aws.us-east-1
}
domain_name = "my-domain.com"
zone_id = "Z266PL4W4W6MSG"
validation_method = "DNS"
wait_for_validation = true
tags = {
Name = "my-domain.com"
}
}
Separate provider aliases for ACM and Route53 are used in split validation patterns.
provider "aws" {
alias = "acm"
}
provider "aws" {
alias = "route53"
}
module "acm" {
source = "terraform-aws-modules/acm/aws"
version = "~> 4.0"
providers = {
aws = aws.acm
}
domain_name = "my-domain.com"
subject_alternative_names = [
"*.my-domain.com",
"app.sub.my-domain.com",
]
validation_method = "DNS"
create_route53_records = false
validation_record_fqdns = module.route53_records.validation_route53_record_fqdns
}
module "route53_records" {
source = "terraform-aws-modules/acm/aws"
version = "~> 4.0"
providers = {
aws = aws.route53
}
create_certificate = false
create_route53_records_only = true
validation_method = "DNS"
distinct_domain_names = module.acm.distinct_domain_names
zone_id = "Z266PL4W4W6MSG"
acm_certificate_domain_validation_options = module.acm.acm_certificate_domain_validation_options
}
The documentation references Complete example with DNS validation recommended, Complete example with DNS validation via external DNS provider CloudFlare, Complete example with EMAIL validation, Complete example with EMAIL validation and validation domain override.
Version Requirements and Dependencies
| Name | Version |
|---|---|
| terraform | >= 1.5.7 |
| aws | >= 6.28 |
| Name | Version |
|---|---|
| aws | >= 6.28 |
No modules.
| Name | Type |
|---|---|
| awsacmcertificate.this | resource |
| awsacmcertificate_validation.this | resource |
| awsroute53record.validation | resource |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| acmcertificatedomainvalidationoptions | A list of domainvalidationoptions created by the ACM certificate to create required Route53 records from it used when createroute53records_only is set to true | any | {} | no |
| certificatetransparencylogging_preference | Specifies whether certificate details should be added to a certificate transparency log | bool | true | no |
| create_certificate | Whether to create ACM certificate | bool | true | no |
| createroute53records | When validation is set to DNS, define whether to create the DNS records internally via Route53 or externally using any DNS provider | bool | true | no |
| createroute53records_only | Whether to create only Route53 records e.g |
The impact of version constraints is that teams must maintain Terraform 1.5.7 or later and AWS provider 6.28 or later to use the current module inputs and resources.
Validation Methods and DNS Integration
Validation method DNS is recommended. The module creates ACM certificates and validates them using Route53 DNS recommended or e-mail.
When createroute53records is set to false, validationrecordfqdns can be supplied manually. This pattern is used when DNS validation is performed outside the module or with an external DNS provider.
The module exposes createroute53records to define whether to create DNS records internally via Route53 or externally using any DNS provider. Default is true.
createroute53records_only allows creation of only Route53 records with an existing certificate.
The split provider pattern demonstrates separation of ACM creation and Route53 record creation across different AWS providers and accounts.
Compliance Controls and Security Posture
Compliance controls are checked at terraform plan time.
Mapped compliance frameworks show which controls from this module are active under each framework endpoint.
| Control | PCI DSS v4.0 |
|---|---|
| ACM certificates should not use wildcard certificates | ○ |
| ACM RSA certificates should use a key length of at least 2,048 bits | ● |
| ACM certificates should have transparency logging enabled | ○ |
● enforced by default · ○ not activated by this endpoint
The enforced control ACM RSA certificates should use a key length of at least 2,048 bits is active under PCI DSS v4.0 by default. The real-world consequence for users is that Terraform plans will be blocked or flagged if RSA key length is below 2048 bits, preventing deployment of weak certificates that could be vulnerable to factorization attacks.
The non-activated controls ACM certificates should not use wildcard certificates and ACM certificates should have transparency logging enabled are not enforced by this endpoint. Impact layer for users is that wildcard usage and transparency logging preference remain discretionary under PCI DSS v4.0 mapping in this module, allowing teams to decide policy separately.
Certificate transparency logging preference is a module input. Specifies whether certificate details should be added to a certificate transparency log. Default is true. The ACM Configuration example sets certificatetransparencylogging_preference to ENABLED.
Operational Considerations and Migration
Migration from upstream terraform-aws-modules is supported by changing only the source URL with same arguments and same outputs. Controls are checked at terraform plan.
Reversibility is guaranteed. No lock-in. Switch back by reverting the source URL. Run terraform init -upgrade. Terraform state is unchanged with same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Sometimes you need to have a way to create ACM certificate conditionally but Terraform does not allow to use.
If upgrading to v2.13.0 or above, you might be subject to off-by-one validation record issue. You can solve this without compromising existing validation records by issuing
terraform state rm <your_module_name>.validation[1]
where[1] can be a different index depending on the number of validation records your module creates you can check this with
terraform state list module.<your_module_name>.validation
This guidance preserves existing validation records while correcting state drift after module upgrades.
Integration with AWS Services
AWS Certificate Manager provides SSL TLS certificates for securing applications. Managing AWS Certificate Manager with Terraform includes validation and integration with other AWS services.
Architecture overview shows Certificate Management with ACM for public certificates, Private CA for internal certificates, and Route 53 for DNS validation. Public Certificate Usage with Application Load Balancer and CloudFront distributing traffic to various compute services ECS, EKS, Elastic Beanstalk. Private Certificate Usage with Internal ALB with private certificates for internal services.
The module supports associations used by load balancers, CloudFront distributions, and APIs as stated in the compliance.tf description.
CloudFront supports US East N Virginia Region only for ACM certificate provisioning.
Conclusion
Terraform AWS ACM module usage centers on declarative certificate provisioning with DNS validation and Route53 integration. The module provides standardized inputs for domainname, zoneid, validationmethod, subjectalternativenames, waitforvalidation, createroute53records, and tags. Version constraints enforce Terraform >= 1.5.7 and AWS provider >= 6.28. Compliance controls are evaluated at plan time with PCI DSS v4.0 mapping showing enforced RSA key length minimum 2048 bits and optional wildcard and transparency logging controls. Migration from upstream terraform-aws-modules is source URL only with state preservation and reversible change. Operational patterns include split provider configurations for ACM and Route53 separation, external DNS validation via validationrecord_fqdns, and conditional record creation. The module integrates with Application Load Balancer, CloudFront, and APIs for public TLS and with Private CA for internal TLS. Real-world impact is reduced manual certificate error, consistent validation, and policy enforcement in infrastructure as code pipelines.