Terraform created an ACM (AWS Certificate Manager) certificate for HTTPS, but it requires DNS validation before it becomes active. In this step, you will:
This typically takes 5-15 minutes after adding DNS records. The certificate ARN is required for the Kubernetes ingress in later steps.
AWS Certificate Manager issues free SSL certificates, but it needs to verify you control the domain. It does this by asking you to add a specific DNS record. When ACM sees the record, it knows you’re the legitimate domain owner and issues the certificate.
This is called “DNS validation” and is the most common method because:
If using public EKS mode: If you configured confident_public_eks = true
(HTTP-only, no HTTPS), you can skip this page. Public mode is only recommended
for testing, not production.
After Terraform apply completes, retrieve the DNS records needed for validation:
Example output:
What this means:
resource_record_name — the DNS record name to createresource_record_type — always CNAME for ACM validationresource_record_value — the value the CNAME should point toMultiple records? If your certificate covers multiple domains (Subject Alternative Names), you’ll see multiple records. You need to create all of them.
You need to add the CNAME record(s) in your DNS provider. The exact steps depend on which provider you use.
resource_record_name (may need to remove the trailing dot)resource_record_value (may need to remove the trailing dot)Common DNS mistakes that cause validation failures:
Extra domain suffix: Some providers automatically append your domain. If the record name is _abc123.yourdomain.com., you may only need to enter _abc123 (the provider adds .yourdomain.com automatically). If you enter the full name, you might end up with _abc123.yourdomain.com.yourdomain.com.
Missing or extra dots: Some providers want the trailing dot, others don’t. Try both if validation fails.
Proxy enabled: If using Cloudflare, ensure the proxy is OFF (gray cloud, “DNS only”). The orange cloud proxies traffic through Cloudflare, which breaks ACM validation.
Wrong record type: Ensure you’re creating a CNAME, not an A record or TXT record.
If your domain is in Route 53, you can create records directly or let Terraform manage them. Manual method: 1. Go to Route 53 → Hosted zones → Select your domain 2. Click “Create record” 3. Enter the record name (without your domain suffix) 4. Select CNAME as record type 5. Paste the validation value 6. Click “Create records” TTL: Use 300 seconds (5 minutes) for faster propagation during validation.
The proxy must be OFF for ACM validation. If the cloud icon is orange, click it to turn it gray.
If your DNS is managed by an internal team: 1. Submit a change request with the exact record details 2. Include the record name, type (CNAME), and value 3. Request expedited processing if possible—this is blocking deployment 4. Ask them to notify you when the change is live
Corporate DNS changes often require change tickets and approval workflows. Factor this into your timeline—it can add hours or days to deployment.
After adding DNS records, ACM automatically detects them and validates your certificate. This typically takes:
Via AWS Console:
Via CLI:
Expected output when validated: "ISSUED"
If validation is taking longer than expected, verify your DNS records are visible globally:
_abc123.yourdomain.com)Certificate stuck in “Pending validation”?
Common causes:
ACM retries validation every few minutes. Once the record is correct and propagated, it should validate automatically.
Once your certificate shows “Issued” status, get the ARN for use in the Kubernetes ingress:
Example output:
Copy the ARN carefully. Some terminals add a % character at the end of
output (this is a shell formatting artifact). Don’t include the % when you
paste the ARN elsewhere.
Save this ARN—you’ll need it when configuring the Kubernetes ingress to enable HTTPS on the load balancer.
ACM certificates are valid for 13 months and renew automatically as long as the validation DNS records remain in place.
Don’t delete the validation DNS records. While they’re only strictly needed during initial validation, leaving them in place allows automatic renewal without any manual intervention.
After the certificate is validated and issued, proceed to Cluster Access to configure kubectl access to your EKS cluster.