How to Fix TLS Certificate Deployment Via CloudFormation
ACM.248 This process needs some love ❤️
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics | Code.
🔒 Related Stories: Application Security | Secure Code | AWS Security | TLS
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I’ve been writing about TLS certificate deployment. Yesterday’s topic was Certificate Transparency logs and the data they may expose.
I started writing the next post on deployment of an S3 bucket but I inadvertently redeployed my TLS certificate and got some errors. And unfortunately, that is why you are not getting a post about creating an S3 bucket for a static website just yet.
After accidentally re-deploying the stack, everything got into a wonky state due to the way this whole process works. I spent way too long diving into the errors I was getting and how to fix them. So now you get this post. Because that unnecessary loss of time is easily resolved with a few changes to the TLS certificate validation process.
You can read the prior posts to get the gist of the problems.
Because I could sense these problems before even ever attempting to do this — it’s something I’ve never fully automated before. And you probably know by now I am a huge advocate of automation. But this is just a house of cards. Maybe there is a better way to do it — but if so the CloudFormation documentation is not making that super clear.
For the number of times I have to create a TLS certificate in the past, all the edge cases I have to handle and weird queries I needed to write to make it work were not worth it. But I did it for you, my readers. And maybe someone at AWS will read it all and fix it.
The fix is very simple. When I say simple I mean conceptually. I don’t know how simple it is to change the related back end AWS Systems. Backwards compatibility also needs to be supported for those who have processes depended on this implementation.
- Do not leave the TLS certificate stack in a hanging state as I demonstrated in prior posts. This makes it impossible to solve this problem in a single script (unless you have some OS-dependent code to kill a script).
- When initial deployment of a TLS certificate completes it is successful and the process ends, but the state of the TLS certificate is UNVALIDATED.
- After initial deployment the CNAME validation values are available to add as outputs of the CloudFormation stack.
- The user can query the stack outputs for the values require to create a CNAME record as I did in my posts above.
- After the CNAME is created, redeploy the same TLS certificate stack again. The state of the certificate turns to VALIDATED. The CNAME name and values are still available as outputs.
With the above I can write a single script:

That would be so much easier to work with.
Delete ALL resources created with CloudFormation when a stack is deleted
Also, CloudFormation stacks that create CNAMES should be able to delete the CNAMES. (Also IAM Users.) If you want to make that an extra override then fine but it’s a pain to have to do that separately.
There’s a way to retain resources if people don’t want that to happen, and stack termination protection. People need to use the platform properly, not have it work in inconsistent ways.

Just to delete a record so I could redeploy it and make use of CloudFormation drift detection I had to fix this error:
Like this:
It would be awesome if that got fixed. It is currently taking me an inordinate amount of time to deal with weird queries and edge cases to make this work and the alternative feels so clean and beautiful. 💙
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
