fix(acm): validated certificate survives eventual consistency in service

[michirue]

The DomainValidationOptions array could be empty, which would make the custom resource fail.

Handle that case, and limit the amount of retries.

Fixes #3527.

---

Please read the contribution guidelines and follow the pull-request checklist.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[hoegertn]

I think

await sleep(Math.random() * (Math.pow(attempt, 2) * 100));

should be

await sleep(Math.random() * (Math.pow(2, attempt) * 100));

Can you add this fix? Then my PR is obsolete.

[hoegertn]

Next thing is that it only uses the first DomainValidation. If there are more ResourceRecords to set (e.g. for SANs) they are not populated in R53.

[michirue]

I think

await sleep(Math.random() * (Math.pow(attempt, 2) * 100));

should be

await sleep(Math.random() * (Math.pow(2, attempt) * 100));

Can you add this fix? Then my PR is obsolete.

Agree. Changed to 2^attempt.

[michirue]

Next thing is that it only uses the first DomainValidation. If there are more ResourceRecords to set (e.g. for SANs) they are not populated in R53.

Yes, it should also support providing a SAN/HostedZoneId map instead of a single hosted zone to cover all ACM/Route53 certificate creation scenarios.

[stephankaag]

I had to adjust the max attempts to 5 before it worked for me, but after that, it worked 👍