使用 Terraform 验证 AWS ACM 认证时出现问题

Question

免责声明：我对 AWS 和 Terraform 都是新手。

我正在测试一些东西，在部署我的代码时，在运行 Terraform Apply 后我不断遇到相同的错误。

Error describing created certificate: Expected certificate to be issued but was in state PENDING_VALIDATION

我尝试多次运行我的代码，每次都会超时 60 分钟。由于会话超时，我不能超过 60 分钟。

为此，需要执行两个步骤：

1. 在帐户 2 中创建托管区域（此操作由同事完成并成功完成）

resource "aws_route53_zone" "<example>" {

  name  = "<domain name>"

2.创建 A 记录、ACM 证书、验证记录和验证对象在帐户1中，

resource "aws_route53_record" "<service>" {
  provider = aws.account2
  zone_id  = data.terraform_remote_state.account2.outputs.route53_<example>_zone_id[0]
  name     = var.domain_name
  type     = "A"

  alias {
    name                   = aws_alb.<service>.dns_name
    zone_id                = aws_alb.<service>.zone_id
    evaluate_target_health = true
  }
}

resource "aws_acm_certificate" "<service>" {
  domain_name       = var.domain_name
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "<service>_validation" {
  provider = aws.account2
  for_each = {
    for dvo in aws_acm_certificate.<service>.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.terraform_remote_state.account2.outputs.route53_<example>_zone_id[0]
}

resource "aws_acm_certificate_validation" "<service>" {
  certificate_arn         = aws_acm_certificate.<service>.arn
  validation_record_fqdns = [for record in aws_route53_record.<service>_validation : record.fqdn]
  

  timeouts {
    create = "60m"
  }
}

我在网上看了很多例子，但还不知道我哪里出错了。这是我的 Terraform 应用的最后一部分。

我检查了 Account2 上的 AWS 控制台，发现子域托管区域已创建并包含必要的 NS 记录，如此处所述 https://aws.amazon.com/premiumsupport/knowledge-center/create-subdomain-route-53/

当我挖掘 A <域名>

; <<>> DiG 9.16.1-Ubuntu <<>> A <domain name>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48891
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;<domain name>. IN  A

;; AUTHORITY SECTION:
<parent domain>.       300     IN      SOA     <xxxxxx>.com. <xxxx>.com. 1 14400 3600 604800 300

;; Query time: 100 msec
;; SERVER: x.x.x.x#53(x.x.x.x)
;; WHEN: Fri Apr 01 20:11:12 PDT 2022
;; MSG SIZE  rcvd: 152