AWS Cloudformation Template with letsencrypt SSL certificate - aws-cloudformation

Question

I want to create a AWS Cloudformation Template with
single EC2 instance which has a apache webserver and a letsencrypt SSL certificate
a Route53 A record which is a dynamic template parameter
I can get letsencrypt to run, because I need to complete a challenge https://letsencrypt.org/de/docs/challenge-types/.
The problem: The HTTP-01 challenge needs the Route53 A record to be created before the EC2 instance, but this is not possible because I need the IP address of the EC2 instance to create the Route53 A record.
I thought about using an EIP but the EIP can only be associated after the EC2 instance is created not on the same time, so the challenge fails too.
The dns-01 challenge is not possible in cloudformation.

Answer 1

This will install a certbot SSL certificate on a Amazon Linux 2 EC2 instance with an apache webserver
The Problem is, that for the ssl verfifcation challenge, you would need a domain pointing to that EC2 instance, but the domain can olny be set after the EC2 instance creation with cloudformation.
I found a solution which waits until the domain is set with CloudFormation
Resources:
WebServerInstance:
Type: AWS::EC2::Instance
Metadata:
AWS::CloudFormation::Init:
InstallApache:
packages:
yum:
httpd: []
InstallCerbotSsl:
packages:
yum:
certbot: []
python2-certbot-apache: []
files:
/use/bin/install_certbot_after_domain_is_set_route53.sh:
content: !Sub |
#!/bin/bash
while true; do
certbot -i apache -a apache --preferred-challenges http -d "${Domain}" -m ${AdminEmail} -n --redirect --agree-tos
if [ $? -eq 0 ]
then
echo "Certbot success"
service httpd restart
break
else
echo "retry..."
sleep 10
fi
done
mode: '000600'
owner: root
group: root
InstallCrontab:
files:
/var/spool/cron/root:
content: !Sub |
# m h dom mon dow command
39 1,13 * * * certbot renew --no-self-upgrade > /dev/null 2>&1
mode: '000600'
owner: root
group: root
this will a a domain to the stack, which the certbot needs to verify the httpd challenge:
DNSRecord:
Type: AWS::Route53::RecordSet
Properties:
HostedZoneName: foo.de.
Name: !Ref Domain
Type: A
TTL: 300
ResourceRecords:
- !GetAtt WebServerInstance.PublicIp
and a UserData trigger, which is executed after the creation success signal fpr the CF Stack to step on in the creation process
UserData:
# is executed as root user
Fn::Base64: !Sub |
#!/bin/bash
# create EC2 instance
yum update -y aws-cfn-bootstrap
# create EC2 instance
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerInstance --configsets InstallAndRun --region ${AWS::Region}
# send create success signal to cloudformation
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerInstance --region ${AWS::Region}
# update all packages to latest
yum update -y
service httpd restart
# install certbot sll certificate, can take some time until domain is set
bash /use/bin/install_certbot_after_domain_is_set_route53.sh > /use/bin/install_certbot.log
# reboot system
reboot