r/appsync_domain_name + association resources

[DrFaust92]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #22088

Output from acceptance testing:

$ make testacc TESTS= TestAccAppSync_serial/DomainName PKG=appsync
        --- PASS: TestAccAppSync_serial/DomainName/description (255.22s)
        --- PASS: TestAccAppSync_serial/DomainName/basic (277.56s)
        --- PASS: TestAccAppSync_serial/DomainName/disappears (268.27s)

$ make testacc TESTS= TestAccAppSync_serial/Association PKG=appsync
    --- PASS: TestAccAppSync_serial/DomainNameAssociation (840.03s)
        --- PASS: TestAccAppSync_serial/DomainNameAssociation/basic (703.23s)
        --- PASS: TestAccAppSync_serial/DomainNameAssociation/disappears (136.80s)

[ewbankkit]

LGTM 🚀.

Unable to verify due to not having a suitable certificate.

% AWS_APPSYNC_DOMAIN_NAME_CERTIFICATE_DOMAIN=example.com make testacc TESTS=TestAccAppSync_serial/DomainName PKG=appsync
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/appsync/... -v -count 1 -parallel 20 -run='TestAccAppSync_serial/DomainName'  -timeout 180m
=== RUN   TestAccAppSync_serial
=== RUN   TestAccAppSync_serial/DomainName
=== RUN   TestAccAppSync_serial/DomainName/description
    domain_name_test.go:59: Step 1/3 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
=== RUN   TestAccAppSync_serial/DomainName/basic
    domain_name_test.go:28: Step 1/2 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
=== RUN   TestAccAppSync_serial/DomainName/disappears
    domain_name_test.go:96: Step 1/1 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
=== RUN   TestAccAppSync_serial/DomainNameAssociation
=== RUN   TestAccAppSync_serial/DomainNameAssociation/basic
    domain_name_api_association_test.go:27: Step 1/3 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
=== RUN   TestAccAppSync_serial/DomainNameAssociation/disappears
    domain_name_api_association_test.go:66: Step 1/1 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
--- FAIL: TestAccAppSync_serial (9.57s)
    --- FAIL: TestAccAppSync_serial/DomainName (6.24s)
        --- FAIL: TestAccAppSync_serial/DomainName/description (2.78s)
        --- FAIL: TestAccAppSync_serial/DomainName/basic (1.74s)
        --- FAIL: TestAccAppSync_serial/DomainName/disappears (1.71s)
    --- FAIL: TestAccAppSync_serial/DomainNameAssociation (3.33s)
        --- FAIL: TestAccAppSync_serial/DomainNameAssociation/basic (1.65s)
        --- FAIL: TestAccAppSync_serial/DomainNameAssociation/disappears (1.69s)
FAIL
FAIL	github.com/hashicorp/terraform-provider-aws/internal/service/appsync	12.958s
FAIL
make: *** [testacc] Error 1
% AWS_APPSYNC_DOMAIN_NAME_CERTIFICATE_DOMAIN=example.com make testacc TESTS=TestAccAppSync_serial/Association PKG=appsync
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/appsync/... -v -count 1 -parallel 20 -run='TestAccAppSync_serial/Association'  -timeout 180m
=== RUN   TestAccAppSync_serial
=== RUN   TestAccAppSync_serial/DomainNameAssociation
=== RUN   TestAccAppSync_serial/DomainNameAssociation/basic
    domain_name_api_association_test.go:27: Step 1/3 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
=== RUN   TestAccAppSync_serial/DomainNameAssociation/disappears
    domain_name_api_association_test.go:66: Step 1/1 error: Error running pre-apply refresh: exit status 1
        
        Error: No certificate for domain "*.example.com" found in this region
        
          with data.aws_acm_certificate.test,
          on terraform_plugin_test.tf line 6, in data "aws_acm_certificate" "test":
           6: data "aws_acm_certificate" "test" {
        
--- FAIL: TestAccAppSync_serial (4.08s)
    --- FAIL: TestAccAppSync_serial/DomainNameAssociation (4.08s)
        --- FAIL: TestAccAppSync_serial/DomainNameAssociation/basic (2.44s)
        --- FAIL: TestAccAppSync_serial/DomainNameAssociation/disappears (1.64s)
FAIL
FAIL	github.com/hashicorp/terraform-provider-aws/internal/service/appsync	7.463s
FAIL
make: *** [testacc] Error 1

[bobsut]

@DrFaust92 - Thanks for this!

Please help clarify the parameters and exports. In the example below, for aws_route53_record.example.alias.name should I use aws_appsync_domain_name.example.id or aws_appsync_domain_name.example.appsync_domain_name?

I suggest adopting the phrases that describe similar exported values from aws_api_gateway_domain_name or aws_apigatewayv2_domain_name, something like

• id - "The identifier assigned to this endpoint domain name by AppSync"
• appsync_domain_name - "The internal hostname assigned to this endpoint by AppSync"
• hosted_zone_id - "The hosted zone ID that can be used to create a Route53 alias record for the endpoint."

I would submit a PR with these documentation changes, but I'm not entirely confident I got them right based on my reading of the existing descriptions.

resource "aws_appsync_domain_name" "example" {
  domain_name     = "graphql.${local.fqdn}"
  certificate_arn = aws_acm_certificate_validation.stardotfqdn.certificate_arn
}

resource "aws_appsync_domain_name_api_association" "example" {
  api_id      = aws_appsync_graphql_api.example.id
  domain_name = aws_appsync_domain_name.example.domain_name
}

resource "aws_route53_record" "example" {
  name    = aws_appsync_domain_name.example.appsync_domain_name
  type    = "A"
  zone_id = data.aws_route53_zone.fqdn.zone_id
  alias {
    name                   = aws_appsync_domain_name.example.appsync_domain_name
    zone_id                = aws_appsync_domain_name.example.hosted_zone_id
    evaluate_target_health = true
  }
  allow_overwrite = true
}

resource "aws_route53_record" "example6" {
  name    = aws_appsync_domain_name.example.appsync_domain_name
  type    = "AAAA"
  count   = local.enable_ipv6 ? 1 : 0
  zone_id = data.aws_route53_zone.fqdn.zone_id
  alias {
    name                   = aws_appsync_domain_name.example.appsync_domain_name
    zone_id                = aws_appsync_domain_name.example.hosted_zone_id
    evaluate_target_health = true
  }
  allow_overwrite = true
}

#
# support resources for completeness
#

locals {
  enable_ipv6 = true
  fqdn        = "example.com"
}

data "aws_route53_zone" "fqdn" {
  name         = local.fqdn
  private_zone = false
}

resource "aws_appsync_graphql_api" "example" {
  name                = "example"
  authentication-type = "API_KEY"
  # ...
}

resource "aws_acm_certificate" "stardotfqdn" {
  domain_name               = local.fqdn
  subject_alternative_names = ["*.${local.fqdn}"]
  validation_method         = "DNS"
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_acm_certificate_validation" "stardotfqdn" {
  certificate_arn         = aws_acm_certificate.stardotfqdn.arn
  validation_record_fqdns = [for record in aws_route53_record.stardotfqdn : record.fqdn]
}

resource "aws_route53_record" "stardotfqdn" {
  for_each = {
    for dvo in aws_acm_certificate.stardotfqdn.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }
  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.fqdn.zone_id
}

[github-actions]

This functionality has been released in v3.73.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.