Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. AWS Cloud Control
  4. API Docs
  5. certificatemanager
  6. Certificate

We recommend new projects start with resources from the AWS provider.

Viewing docs for AWS Cloud Control v1.74.1
published on Monday, Aug 3, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws-native

aws-native.certificatemanager.Certificate

aws-native logo

We recommend new projects start with resources from the AWS provider.

Viewing docs for AWS Cloud Control v1.74.1
published on Monday, Aug 3, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws-native

    Resource Type definition for AWS::CertificateManager::Certificate

    Example Usage

    Example

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var config = new Config();
    var basePath = config.Get("basePath") ?? "examplepath";
    var domainName = config.Get("domainName") ?? "example.mydomain.com";
    var restApiName = config.Get("restApiName") ?? "exampleapi";
    var myCertificate = new AwsNative.CertificateManager.Certificate("myCertificate", new()
    {
        DomainName = domainName,
    });

    var myDomainName = new AwsNative.ApiGateway.DomainName("myDomainName", new()
    {
        CertificateArn = myCertificate.Id,
        DomainNameValue = domainName,
    });

    var myRestApi = new AwsNative.ApiGateway.RestApi("myRestApi", new()
    {
        Name = restApiName,
    });

    var myMapping = new AwsNative.ApiGateway.BasePathMapping("myMapping", new()
    {
        BasePath = basePath,
        DomainName = myDomainName.Id,
        RestApiId = myRestApi.Id,
    });

    return new Dictionary<string, object?>
    {
        ["domainName0"] = myDomainName.DistributionDomainName,
    };
});

    package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/apigateway"
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/certificatemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		basePath := "examplepath"
		if param := cfg.Get("basePath"); param != "" {
			basePath = param
		}
		domainName := "example.mydomain.com"
		if param := cfg.Get("domainName"); param != "" {
			domainName = param
		}
		restApiName := "exampleapi"
		if param := cfg.Get("restApiName"); param != "" {
			restApiName = param
		}
		myCertificate, err := certificatemanager.NewCertificate(ctx, "myCertificate", &certificatemanager.CertificateArgs{
			DomainName: pulumi.String(domainName),
		})
		if err != nil {
			return err
		}
		myDomainName, err := apigateway.NewDomainName(ctx, "myDomainName", &apigateway.DomainNameArgs{
			CertificateArn: myCertificate.ID(),
			DomainName:     pulumi.String(domainName),
		})
		if err != nil {
			return err
		}
		myRestApi, err := apigateway.NewRestApi(ctx, "myRestApi", &apigateway.RestApiArgs{
			Name: pulumi.String(restApiName),
		})
		if err != nil {
			return err
		}
		_, err = apigateway.NewBasePathMapping(ctx, "myMapping", &apigateway.BasePathMappingArgs{
			BasePath:   pulumi.String(basePath),
			DomainName: myDomainName.ID(),
			RestApiId:  myRestApi.ID(),
		})
		if err != nil {
			return err
		}
		ctx.Export("domainName0", myDomainName.DistributionDomainName)
		return nil
	})
}

    Example coming soon!

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const config = new pulumi.Config();
const basePath = config.get("basePath") || "examplepath";
const domainName = config.get("domainName") || "example.mydomain.com";
const restApiName = config.get("restApiName") || "exampleapi";
const myCertificate = new aws_native.certificatemanager.Certificate("myCertificate", {domainName: domainName});
const myDomainName = new aws_native.apigateway.DomainName("myDomainName", {
    certificateArn: myCertificate.id,
    domainName: domainName,
});
const myRestApi = new aws_native.apigateway.RestApi("myRestApi", {name: restApiName});
const myMapping = new aws_native.apigateway.BasePathMapping("myMapping", {
    basePath: basePath,
    domainName: myDomainName.id,
    restApiId: myRestApi.id,
});
export const domainName0 = myDomainName.distributionDomainName;

    import pulumi
import pulumi_aws_native as aws_native

config = pulumi.Config()
base_path = config.get("basePath")
if base_path is None:
    base_path = "examplepath"
domain_name = config.get("domainName")
if domain_name is None:
    domain_name = "example.mydomain.com"
rest_api_name = config.get("restApiName")
if rest_api_name is None:
    rest_api_name = "exampleapi"
my_certificate = aws_native.certificatemanager.Certificate("myCertificate", domain_name=domain_name)
my_domain_name = aws_native.apigateway.DomainName("myDomainName",
    certificate_arn=my_certificate.id,
    domain_name=domain_name)
my_rest_api = aws_native.apigateway.RestApi("myRestApi", name=rest_api_name)
my_mapping = aws_native.apigateway.BasePathMapping("myMapping",
    base_path=base_path,
    domain_name=my_domain_name.id,
    rest_api_id=my_rest_api.id)
pulumi.export("domainName0", my_domain_name.distribution_domain_name)

    Example coming soon!

    Example

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var config = new Config();
    var basePath = config.Get("basePath") ?? "examplepath";
    var domainName = config.Get("domainName") ?? "example.mydomain.com";
    var restApiName = config.Get("restApiName") ?? "exampleapi";
    var myCertificate = new AwsNative.CertificateManager.Certificate("myCertificate", new()
    {
        DomainName = domainName,
    });

    var myDomainName = new AwsNative.ApiGateway.DomainName("myDomainName", new()
    {
        CertificateArn = myCertificate.Id,
        DomainNameValue = domainName,
    });

    var myRestApi = new AwsNative.ApiGateway.RestApi("myRestApi", new()
    {
        Name = restApiName,
    });

    var myMapping = new AwsNative.ApiGateway.BasePathMapping("myMapping", new()
    {
        BasePath = basePath,
        DomainName = myDomainName.Id,
        RestApiId = myRestApi.Id,
    });

    return new Dictionary<string, object?>
    {
        ["domainName0"] = myDomainName.DistributionDomainName,
    };
});

    package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/apigateway"
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/certificatemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		basePath := "examplepath"
		if param := cfg.Get("basePath"); param != "" {
			basePath = param
		}
		domainName := "example.mydomain.com"
		if param := cfg.Get("domainName"); param != "" {
			domainName = param
		}
		restApiName := "exampleapi"
		if param := cfg.Get("restApiName"); param != "" {
			restApiName = param
		}
		myCertificate, err := certificatemanager.NewCertificate(ctx, "myCertificate", &certificatemanager.CertificateArgs{
			DomainName: pulumi.String(domainName),
		})
		if err != nil {
			return err
		}
		myDomainName, err := apigateway.NewDomainName(ctx, "myDomainName", &apigateway.DomainNameArgs{
			CertificateArn: myCertificate.ID(),
			DomainName:     pulumi.String(domainName),
		})
		if err != nil {
			return err
		}
		myRestApi, err := apigateway.NewRestApi(ctx, "myRestApi", &apigateway.RestApiArgs{
			Name: pulumi.String(restApiName),
		})
		if err != nil {
			return err
		}
		_, err = apigateway.NewBasePathMapping(ctx, "myMapping", &apigateway.BasePathMappingArgs{
			BasePath:   pulumi.String(basePath),
			DomainName: myDomainName.ID(),
			RestApiId:  myRestApi.ID(),
		})
		if err != nil {
			return err
		}
		ctx.Export("domainName0", myDomainName.DistributionDomainName)
		return nil
	})
}

    Example coming soon!

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const config = new pulumi.Config();
const basePath = config.get("basePath") || "examplepath";
const domainName = config.get("domainName") || "example.mydomain.com";
const restApiName = config.get("restApiName") || "exampleapi";
const myCertificate = new aws_native.certificatemanager.Certificate("myCertificate", {domainName: domainName});
const myDomainName = new aws_native.apigateway.DomainName("myDomainName", {
    certificateArn: myCertificate.id,
    domainName: domainName,
});
const myRestApi = new aws_native.apigateway.RestApi("myRestApi", {name: restApiName});
const myMapping = new aws_native.apigateway.BasePathMapping("myMapping", {
    basePath: basePath,
    domainName: myDomainName.id,
    restApiId: myRestApi.id,
});
export const domainName0 = myDomainName.distributionDomainName;

    import pulumi
import pulumi_aws_native as aws_native

config = pulumi.Config()
base_path = config.get("basePath")
if base_path is None:
    base_path = "examplepath"
domain_name = config.get("domainName")
if domain_name is None:
    domain_name = "example.mydomain.com"
rest_api_name = config.get("restApiName")
if rest_api_name is None:
    rest_api_name = "exampleapi"
my_certificate = aws_native.certificatemanager.Certificate("myCertificate", domain_name=domain_name)
my_domain_name = aws_native.apigateway.DomainName("myDomainName",
    certificate_arn=my_certificate.id,
    domain_name=domain_name)
my_rest_api = aws_native.apigateway.RestApi("myRestApi", name=rest_api_name)
my_mapping = aws_native.apigateway.BasePathMapping("myMapping",
    base_path=base_path,
    domain_name=my_domain_name.id,
    rest_api_id=my_rest_api.id)
pulumi.export("domainName0", my_domain_name.distribution_domain_name)

    Example coming soon!

    Example

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var myCertificate = new AwsNative.CertificateManager.Certificate("myCertificate", new()
    {
        DomainName = "example.com",
        ValidationMethod = "DNS",
    });

});

    package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/certificatemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := certificatemanager.NewCertificate(ctx, "myCertificate", &certificatemanager.CertificateArgs{
			DomainName:       pulumi.String("example.com"),
			ValidationMethod: pulumi.String("DNS"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    Example coming soon!

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const myCertificate = new aws_native.certificatemanager.Certificate("myCertificate", {
    domainName: "example.com",
    validationMethod: "DNS",
});

    import pulumi
import pulumi_aws_native as aws_native

my_certificate = aws_native.certificatemanager.Certificate("myCertificate",
    domain_name="example.com",
    validation_method="DNS")

    Example coming soon!

    Example

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var myCertificate = new AwsNative.CertificateManager.Certificate("myCertificate", new()
    {
        DomainName = "example.com",
        ValidationMethod = "DNS",
    });

});

    package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/certificatemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := certificatemanager.NewCertificate(ctx, "myCertificate", &certificatemanager.CertificateArgs{
			DomainName:       pulumi.String("example.com"),
			ValidationMethod: pulumi.String("DNS"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    Example coming soon!

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const myCertificate = new aws_native.certificatemanager.Certificate("myCertificate", {
    domainName: "example.com",
    validationMethod: "DNS",
});

    import pulumi
import pulumi_aws_native as aws_native

my_certificate = aws_native.certificatemanager.Certificate("myCertificate",
    domain_name="example.com",
    validation_method="DNS")

    Example coming soon!

    Create Certificate Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Certificate(name: string, args: CertificateArgs, opts?: CustomResourceOptions);
    @overload
def Certificate(resource_name: str,
                args: CertificateArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def Certificate(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                domain_name: Optional[str] = None,
                certificate_authority_arn: Optional[str] = None,
                certificate_export: Optional[CertificateExport] = None,
                certificate_transparency_logging_preference: Optional[CertificateTransparencyLoggingPreference] = None,
                domain_validation_options: Optional[Sequence[CertificateDomainValidationOptionArgs]] = None,
                key_algorithm: Optional[str] = None,
                subject_alternative_names: Optional[Sequence[str]] = None,
                tags: Optional[Sequence[_root_inputs.TagArgs]] = None,
                validation_method: Optional[str] = None)
    func NewCertificate(ctx *Context, name string, args CertificateArgs, opts ...ResourceOption) (*Certificate, error)
    public Certificate(string name, CertificateArgs args, CustomResourceOptions? opts = null)
    public Certificate(String name, CertificateArgs args)
public Certificate(String name, CertificateArgs args, CustomResourceOptions options)

    type: aws-native:certificatemanager:Certificate
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws-native_certificatemanager_certificate" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args CertificateArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CertificateArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CertificateArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CertificateArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CertificateArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Certificate Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Certificate resource accepts the following input properties:

    DomainName string
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    CertificateAuthorityArn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    CertificateExport Pulumi.AwsNative.CertificateManager.CertificateExport
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    CertificateTransparencyLoggingPreference Pulumi.AwsNative.CertificateManager.CertificateTransparencyLoggingPreference
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    DomainValidationOptions List<Pulumi.AwsNative.CertificateManager.Inputs.CertificateDomainValidationOption>
    Domain information that domain name registrars use to verify your identity.
    KeyAlgorithm string
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    SubjectAlternativeNames List<string>
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    Tags List<Pulumi.AwsNative.Inputs.Tag>
    Key-value pairs that can identify the certificate.
    ValidationMethod string
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP
    DomainName string
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    CertificateAuthorityArn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    CertificateExport CertificateExport
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    CertificateTransparencyLoggingPreference CertificateTransparencyLoggingPreference
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    DomainValidationOptions []CertificateDomainValidationOptionArgs
    Domain information that domain name registrars use to verify your identity.
    KeyAlgorithm string
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    SubjectAlternativeNames []string
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    Tags TagArgs
    Key-value pairs that can identify the certificate.
    ValidationMethod string
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP
    domain_name string
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    certificate_authority_arn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    certificate_export "ENABLED" | "DISABLED"
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    certificate_transparency_logging_preference "ENABLED" | "DISABLED"
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    domain_validation_options list(object)
    Domain information that domain name registrars use to verify your identity.
    key_algorithm string
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    subject_alternative_names list(string)
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    tags list(object)
    Key-value pairs that can identify the certificate.
    validation_method string
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP
    domainName String
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    certificateAuthorityArn String
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    certificateExport CertificateExport
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    certificateTransparencyLoggingPreference CertificateTransparencyLoggingPreference
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    domainValidationOptions List<CertificateDomainValidationOption>
    Domain information that domain name registrars use to verify your identity.
    keyAlgorithm String
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    subjectAlternativeNames List<String>
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    tags List<Tag>
    Key-value pairs that can identify the certificate.
    validationMethod String
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP
    domainName string
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    certificateAuthorityArn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    certificateExport CertificateExport
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    certificateTransparencyLoggingPreference CertificateTransparencyLoggingPreference
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    domainValidationOptions CertificateDomainValidationOption[]
    Domain information that domain name registrars use to verify your identity.
    keyAlgorithm string
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    subjectAlternativeNames string[]
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    tags Tag[]
    Key-value pairs that can identify the certificate.
    validationMethod string
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP
    domain_name str
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    certificate_authority_arn str
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    certificate_export CertificateExport
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    certificate_transparency_logging_preference CertificateTransparencyLoggingPreference
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    domain_validation_options Sequence[CertificateDomainValidationOptionArgs]
    Domain information that domain name registrars use to verify your identity.
    key_algorithm str
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    subject_alternative_names Sequence[str]
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    tags Sequence[TagArgs]
    Key-value pairs that can identify the certificate.
    validation_method str
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP
    domainName String
    The fully qualified domain name (FQDN), such as www.example.com, with which you want to secure an ACM certificate
    certificateAuthorityArn String
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    certificateExport "ENABLED" | "DISABLED"
    Specifies whether the certificate can be exported. ENABLED allows the certificate to be exported, DISABLED prevents export.
    certificateTransparencyLoggingPreference "ENABLED" | "DISABLED"
    You can opt out of certificate transparency logging by specifying the DISABLED option. Opt in by specifying ENABLED.
    domainValidationOptions List<Property Map>
    Domain information that domain name registrars use to verify your identity.
    keyAlgorithm String
    Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
    subjectAlternativeNames List<String>
    Additional FQDNs to be included in the Subject Alternative Name extension of the ACM certificate.
    tags List<Property Map>
    Key-value pairs that can identify the certificate.
    validationMethod String
    The method you want to use to validate that you own or control the domain associated with a public certificate. Valid values are DNS, EMAIL or HTTP

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Certificate resource produces the following output properties:

    CertificateArn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    Id string
    The provider-assigned unique ID for this managed resource.
    CertificateArn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    Id string
    The provider-assigned unique ID for this managed resource.
    certificate_arn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    id string
    The provider-assigned unique ID for this managed resource.
    certificateArn String
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    id String
    The provider-assigned unique ID for this managed resource.
    certificateArn string
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    id string
    The provider-assigned unique ID for this managed resource.
    certificate_arn str
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    id str
    The provider-assigned unique ID for this managed resource.
    certificateArn String
    The Amazon Resource Name (ARN) of the private certificate authority (CA) that will be used to issue the certificate.
    id String
    The provider-assigned unique ID for this managed resource.

    Supporting Types

    CertificateDomainValidationOption, CertificateDomainValidationOptionArgs

    DomainName string
    A fully qualified domain name (FQDN) in the certificate request.
    HostedZoneId string

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    ValidationDomain string
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com
    DomainName string
    A fully qualified domain name (FQDN) in the certificate request.
    HostedZoneId string

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    ValidationDomain string
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com
    domain_name string
    A fully qualified domain name (FQDN) in the certificate request.
    hosted_zone_id string

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    validation_domain string
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com
    domainName String
    A fully qualified domain name (FQDN) in the certificate request.
    hostedZoneId String

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    validationDomain String
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com
    domainName string
    A fully qualified domain name (FQDN) in the certificate request.
    hostedZoneId string

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    validationDomain string
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com
    domain_name str
    A fully qualified domain name (FQDN) in the certificate request.
    hosted_zone_id str

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    validation_domain str
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com
    domainName String
    A fully qualified domain name (FQDN) in the certificate request.
    hostedZoneId String

    The HostedZoneId option, which is available if you are using Route 53 as your domain registrar, causes ACM to add your CNAME to the domain record. Your list of DomainValidationOptions must contain one and only one of the domain-validation options, and the HostedZoneId can be used only when DNS is specified as your validation method.

    Use the Route 53 ListHostedZones API to discover IDs for available hosted zones.

    This option is required for publicly trusted certificates.

    The ListHostedZones API returns IDs in the format "/hostedzone/Z111111QQQQQQQ", but CloudFormation requires the IDs to be in the format "Z111111QQQQQQQ".

    When you change your DomainValidationOptions , a new resource is created.

    validationDomain String
    The domain name to which you want ACM to send validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the DomainName value or a superdomain of the DomainName value. For example, if you request a certificate for testing.example.com , you can specify example.com as this value. In that case, ACM sends domain validation emails to the following five addresses:

    • admin@example.com
    • administrator@example.com
    • hostmaster@example.com
    • postmaster@example.com
    • webmaster@example.com

    CertificateExport, CertificateExportArgs

    Enabled
    ENABLED
    Disabled
    DISABLED
    CertificateExportEnabled
    ENABLED
    CertificateExportDisabled
    DISABLED
    "ENABLED"
    ENABLED
    "DISABLED"
    DISABLED
    Enabled
    ENABLED
    Disabled
    DISABLED
    Enabled
    ENABLED
    Disabled
    DISABLED
    ENABLED
    ENABLED
    DISABLED
    DISABLED
    "ENABLED"
    ENABLED
    "DISABLED"
    DISABLED

    CertificateTransparencyLoggingPreference, CertificateTransparencyLoggingPreferenceArgs

    Enabled
    ENABLED
    Disabled
    DISABLED
    CertificateTransparencyLoggingPreferenceEnabled
    ENABLED
    CertificateTransparencyLoggingPreferenceDisabled
    DISABLED
    "ENABLED"
    ENABLED
    "DISABLED"
    DISABLED
    Enabled
    ENABLED
    Disabled
    DISABLED
    Enabled
    ENABLED
    Disabled
    DISABLED
    ENABLED
    ENABLED
    DISABLED
    DISABLED
    "ENABLED"
    ENABLED
    "DISABLED"
    DISABLED

    Tag, TagArgs

    A set of tags to apply to the resource.
    Key string
    The key name of the tag
    Value string
    The value of the tag
    Key string
    The key name of the tag
    Value string
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key str
    The key name of the tag
    value str
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag

    Package Details

    Repository
    AWS Native pulumi/pulumi-aws-native
    License
    Apache-2.0
    aws-native logo

    We recommend new projects start with resources from the AWS provider.

    Viewing docs for AWS Cloud Control v1.74.1
    published on Monday, Aug 3, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws-native

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial