使用 cloudformation 在云端添加 ssl 证书时出错（需要指定）

Question

{
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Parameters": {
    "AlternateDomainNames": {
        "Description": "CNAMEs (alternate domain names), if any, for the distribution. Example. test.codavel.com",
        "Type": "String",
        "Default": "test.example.com"
    }
},
    "Resources" : {
        "myDistribution" : {
            "Type" : "AWS::CloudFront::Distribution",
            "Properties" : {
                "DistributionConfig" : {
                    "Origins" : [ {
                            "DomainName" : "ELBfor-1234.region.elb.amazonaws.com",
                            "Id" : "myCustomOrigin",
                            "CustomOriginConfig" : {
                                "HTTPPort" : "80",
                                "HTTPSPort" : "443",
                                "OriginProtocolPolicy" : "match-viewer",
                                "OriginSSLProtocols" : [
                            "TLSv1",
                            "TLSv1.1",
                            "TLSv1.2",
                            "SSLv3"
                        ]
                            }
                    } ],
                    "HttpVersion": "http2",
                 "Aliases": [
                   {
                    "Ref": "AlternateDomainNames"
                   }
                 ],
                    "Enabled" : "true",
                    "Comment" : "example-cdn",
                    "DefaultCacheBehavior" : {
                        "TargetOriginId" : "myCustomOrigin",
                        "SmoothStreaming" : "false",
                        "AllowedMethods": [
                            "HEAD",
                            "GET",
                            "OPTIONS"
                        ],
                         "MaxTTL": "31536000",
                         "MinTTL": "0",
                        "Compress" : "true",
                        "ForwardedValues" : {
                            "QueryString" : "false",
                            "Cookies" : { "Forward" : "all" }
                        },
                        "ViewerProtocolPolicy" : "allow-all"
                    },
                   "PriceClass" : "PriceClass_All",
                   "Restrictions" : {
                       "GeoRestriction": {
                            "RestrictionType": "none",
                            "Locations": []
                        }
                   },
                   "ViewerCertificate": { 
                     "SslSupportMethod": "sni-only",
                     "AcmCertificateArn" : {
            "Fn::Sub": "arn:aws:acm:us-east-1:<ID>:certificate/2345f-534234"
        }
}
                   }
                }
            }
        }
    }

大家好，

我在我的云端模板中使用它来添加我的自定义 SSL，它显示了一些错误：- Exactly one of [AcmCertificateArn,CloudFrontDefaultCertificate,IamCertificateId] needs to be specified.

所以请让我知道我将如何添加它，或者是否有任何选项可以添加参数，以便列出该证书。请指导我。这是我的证书 ARN - arn:aws:acm:us-east-1::certificate/2345f-534234

Answer 1

ViewerCertificate 块在您的情况下应该如下所示：

"ViewerCertificate": {
        "SslSupportMethod": "sni-only",
        "AcmCertificateArn": " arn:aws:acm:us-east-1::certificate/2345f-534234"
}

您还应该始终注意的是，证书是在 us-east1 区域中配置的（您的证书是基于 ARN :)

Answer 2

您需要使用的属性是ViewerCertificate。 CloudFormation documentation 中的配置应该可以帮助您确定您可能想要添加的任何选项。

如果要指定ACM证书，可以添加参数，类型为字符串。

以下是更新后的模板。您需要确保 ACM 证书包含您的帐户 ID。我已经运行它来验证它是否成功构建。

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
        "AlternateDomainNames": {
            "Description": "CNAMEs (alternate domain names), if any, for the distribution. Example. test.codavel.com",
            "Type": "String",
            "Default": "test.example.com"
        }
    },
    "Resources": {
        "myDistribution": {
            "Type": "AWS::CloudFront::Distribution",
            "Properties": {
                "DistributionConfig": {
                    "Origins": [{
                        "DomainName": "ELBfor-1234.region.elb.amazonaws.com",
                        "Id": "myCustomOrigin",
                        "CustomOriginConfig": {
                            "HTTPPort": "80",
                            "HTTPSPort": "443",
                            "OriginProtocolPolicy": "match-viewer",
                            "OriginSSLProtocols": [
                                "TLSv1",
                                "TLSv1.1",
                                "TLSv1.2",
                                "SSLv3"
                            ]
                        }
                    }],
                    "ViewerCertificate": {
                        "SslSupportMethod": "sni-only",
                        "AcmCertificateArn": "arn:aws:acm:us-east-1::certificate/2345f-534234"
                    },
                    "HttpVersion": "http2",
                    "Aliases": [{
                        "Ref": "AlternateDomainNames"
                    }],
                    "Enabled": "true",
                    "Comment": "example-cdn",
                    "DefaultCacheBehavior": {
                        "TargetOriginId": "myCustomOrigin",
                        "SmoothStreaming": "false",
                        "AllowedMethods": [
                            "HEAD",
                            "GET",
                            "OPTIONS"
                        ],
                        "MaxTTL": "31536000",
                        "MinTTL": "0",
                        "Compress": "true",
                        "ForwardedValues": {
                            "QueryString": "false",
                            "Cookies": {
                                "Forward": "all"
                            }
                        },
                        "ViewerProtocolPolicy": "allow-all"
                    },
                    "PriceClass": "PriceClass_All",
                    "Restrictions": {
                        "GeoRestriction": {
                            "RestrictionType": "none",
                            "Locations": []
                        }
                    }
                }
            }
        }
    }
}