Create ACM certificate for Snowplow hosted customer

Request a new AWS ACM certificate (DNS validation) for a customer's custom collector domain using the acm_cert_request deployment handler, and retrieve the DNS validation record to hand to the customer so their certificate can be issued.

Should be used where the customers pipeline is hosted by Snowplow.

When to use

- A customer's custom collector domain (e.g. c.customer.com) needs a new TLS certificate — for example, the collector's current certificate doesn't cover a domain the customer wants to track from.

- Support needs a DNS validation CNAME to relay to a customer so a certificate can complete validation.

Steps

1. Confirm the customer's aws_rt_pipeline workspace

a. Identify the client and environment, e.g. com_acme prod1

b. aws_rt_pipeline must already be deployed for that workspace — the handler resolves the target AWS account and region from it

2. Dry-run the handler first in Snowdrift-UI - its aws/acm_cert_request and the domain parameter is the custom domain that you want the custom collector domain for. Confirm that this does what you expect.

3. Run the handler for real in Snowdrift-UI.

a. If no usable certificate exists yet for the domain, ACM issues a new one and the handler prints its ARN

b. If a PENDING_VALIDATION certificate already exists for the domain, the handler reuses it instead of requesting a duplicate

c. If existing certificate(s) are present but none are PENDING_VALIDATION (e.g. EXPIRED, ISSUED, FAILED), the handler logs a warning and exits without requesting a new one — see Notes/Warnings

4. Copy the DNS validation record from the handler output and send to customer

a. The output includes the certificate ARN, status, and a line in the form:

<domain> CNAME <cname-name> -> <cname-value>

b. This is the exact CNAME record (name and value) the customer must add to their DNS

5. Re-check after the customer adds the record

a. Re-run the handler (dry run or real) — an existing PENDING_VALIDATION certificate is safely reused, not duplicated

b. Once AWS validates the DNS record, the certificate status moves to ISSUED automatically

c. Re-running the handler at that point finds no PENDING_VALIDATION certificate and logs a message to say that the certificate has been ISSUED instead

Notes/Warnings

- This handler only requests the certificate and surfaces its DNS validation record — it does not attach the certificate to a load balancer or collector. Attaching the issued certificate is a separate step.

- The handler only reuses an existing certificate for its DNS validation record if its status is PENDING_VALIDATION. An ISSUED certificate is reported as already complete (nothing to hand the customer). Any other status (`EXPIRED`, FAILED, REVOKED, VALIDATION_TIMED_OUT, INACTIVE) means the certificate is unusable — the handler will not silently reuse it, and will not automatically request a fresh one either, so it won't leave you holding a stale CNAME. If you need a brand-new certificate for a domain stuck in this state, create a Work Request or Service Disruption (depends on situation) for SRE to look at

- Every aws acm request-certificate call creates a brand-new certificate/ARN. This is why the handler always checks for an existing PENDING_VALIDATION certificate first — to avoid piling up duplicate pending certificates for the same domain.

- The DNS validation CNAME is stable for the lifetime of a given certificate request — the customer can add it at any time, and re-running the handler against the same PENDING_VALIDATION certificate returns the same record.