acm: reliability improvements for automatically validated certificate

[rix0rrr]

Remarks from Todd Cignetti:

• One thing that’s important to call out in the docs is what happens in the case of a partial failure to write to R53. For example, for a certificate request with multiple domains, some writes to R53 may succeed and others may fail. I presume that the call would fail, but it would not remove the records that it wrote successfully. The good news is that a subsequent call to ACM from the same account with the same domains will generate the same R53 tokens, so repeating the call can be successful.

• Another question is how to maintain the R53 records in conjunction with the cert lifecycle. It would be nice to have a call to remove the records when all of the certificates that use the domain are deleted. Obviously there could be issues here where a domain is still in use with one certificate when another cert that uses the domain is deleted, so it’s not ok just to delete the tokens from R53 when a certificate with that domain is deleted.

[njlynch]

Closing this out.

The first bullet point is addressed by the Javascript SDK's built-in retry mechanism for DnsValidatedCertificate and by the CloudFormation implementation for Certificate. The second point is tracked by #3333, #11201, and #7063.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.