aws_certificatemanager: validating certificate cross account

[andreprawira]

Describe the bug

I have 2 accounts, standard and gov cloud. What i'm trying to do is to create a public hosted zone in standard account and generate a public certificate in gov cloud. I will validate the certificate by bringing its CNAME to the hosted zone. However, i'm confused how can i export the hosted zone id cross account.

Below is the hosted zone stack code

class HostedZoneStack(Stack):
    def __init__(
        self, scope: Construct, construct_id: str,  **kwargs
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # Creating hosted zone
        hosted_zone = route53.HostedZone(
            self,
            "hosted-zone",
            zone_name="dev.keren.com",
        )

        # Creating parameter store to store hosted zone id 
        ssm.StringParameter(
            self,
            "hosted-zone-id",
            string_value=hosted_zone.hosted_zone_id,
            parameter_name="hosted-zone-id",
        )

Below is the acm stack code

class AcmStack(Stack):
    def __init__(
        self, scope: Construct, construct_id: str, **kwargs
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        hosted_zone_id = ssm.StringParameter.from_string_parameter_name(
            self, "hosted-zone-id", string_parameter_name="hosted-zone-id"
        ).string_value

        # Importing hosted zone
        hosted_zone = route53.HostedZone.from_hosted_zone_attributes(
            self, "hosted-zone", hosted_zone_id=hosted_zone_id, zone_name="dev.keren.com"
        )

        # Creating a public certificate
        acm_cert = acm.Certificate(
            self,
            "cloudfront-certificate",
            domain_name="dev.keren.com",
            validation=acm.CertificateValidation.from_dns(hosted_zone),
        )

The problem with the code now is that it the parameter store that holds the hosted zone id is generated in standard account and i dont know how to read it from the gov cloud account. Any idea how can i do that or if theres a better method? Thanks

Expected Behavior

Able to validate certificate cross account

Current Behavior

Parameter store is generated in an account where the other account cant read it

Reproduction Steps

Please view the code above

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.131.0 (build 92b912d)

Framework Version

No response

Node.js Version

v18.18.0

OS

Windows

Language

Python

Language Version

Python 3.11.5

Other information

No response

[khushail]

Hi @andreprawira thanks for reaching out. looks like this issue is quite similar. This comment here also throws some light on the issue of cross-region /cross-account certificate usage.Please have a look and let us know.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.