### Terraform Initialization and Application

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/examples/complete-email-validation/README.md

Standard commands to initialize, plan, and apply a Terraform configuration. Note that this example may incur costs.

```bash
$ terraform init
$ terraform plan
$ terraform apply
```

--------------------------------

### Accessing Wrapper Outputs

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Provides examples of how to access specific outputs from the wrapper module, such as a single certificate ARN or all ARNs.

```hcl
# Get API certificate ARN
module.acm.wrapper.output.wrapper["api"].acm_certificate_arn

# Get all certificate ARNs
{
  api  = module.acm.wrapper.output.wrapper["api"].acm_certificate_arn
  www  = module.acm.wrapper.output.wrapper["www"].acm_certificate_arn
  mail = module.acm.wrapper.output.wrapper["mail"].acm_certificate_arn
}
```

--------------------------------

### Terraform Usage Commands

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/examples/complete-email-validation-with-validation-domain/README.md

Commands to initialize, plan, and apply the Terraform configuration for this example. Ensure you provide the necessary domain names as variables.

```bash
terraform init
terraform plan -var 'domain_name=foo.bar.com' -var 'validation_domain=bar.com'
terraform apply -var 'domain_name=foo.bar.com' -var 'validation_domain=bar.com'
```

--------------------------------

### Terraform Usage Instructions

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/examples/complete-dns-validation/README.md

Standard Terraform commands to initialize, plan, and apply the example configuration. Remember to run `terraform destroy` when resources are no longer needed to avoid ongoing costs.

```bash
terraform init
terraform plan
terraform apply
```

--------------------------------

### Example: Module for Route53 Records Only

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

Demonstrates how to configure the module to only create Route53 records. This scenario is activated when 'create_certificate' is false and 'create_route53_records_only' is true, leveraging the local value defined previously.

```hcl
module "route53" {
  create_certificate = false
  create_route53_records_only = true  # <-- Activates this local
}
```

--------------------------------

### Minimal DNS Validation Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/configuration.md

A basic configuration example for setting up ACM certificate with DNS validation for a single domain.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  zone_id     = "Z2ES7B9AZ6SHAE"
  
  validation_method = "DNS"
}
```

--------------------------------

### Multi-Domain with Shared Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Shows how to configure multiple domains, including wildcard subject alternative names, using shared default settings and applying specific tags per item. This example also demonstrates integration with an ALB listener.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws//wrappers"

  defaults = {
    validation_method              = "DNS"
    zone_id                        = data.aws_route53_zone.main.zone_id
    wait_for_validation            = true
    certificate_transparency_logging_preference = true
    tags = {
      Environment = "production"
      ManagedBy   = "terraform"
      CostCenter  = "platform"
    }
  }

  items = {
    "api" = {
      domain_name = "api.example.com"
      subject_alternative_names = [
        "*.api.example.com",
      ]
      tags = {
        Service = "api"
      }
    }
    "www" = {
      domain_name = "example.com"
      subject_alternative_names = [
        "www.example.com",
        "*.example.com",
      ]
      tags = {
        Service = "website"
      }
    }
    "mail" = {
      domain_name = "mail.example.com"
      tags = {
        Service = "mail"
      }
    }
  }
}

# Use with ALB
resource "aws_lb_listener" "https" {
  for_each = module.acm.wrapper

  load_balancer_arn = aws_lb.main.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn   = each.value.acm_certificate_arn

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      message_body = "OK"
      status_code  = "200"
    }
  }
}
```

--------------------------------

### Variable Resolution Logic Example 2

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Shows variable resolution when the item does not specify a value, and the 'defaults' value is used.

```hcl
# Item configuration
items = {
  "api" = {
    domain_name = "api.example.com"
    # validation_method not specified
  }
}

# Defaults
defaults = {
  validation_method = "DNS"
}

# Resolution
try(each.value.validation_method, var.defaults.validation_method, null)
=> each.value.validation_method missing, try next
=> var.defaults.validation_method = "DNS"
=> Result: "DNS"
```

--------------------------------

### Local Terraform Installation Verification

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Verify that the installed Terraform version meets the minimum requirement. This command is useful for local development and testing.

```bash
# Install Terraform
terraform version  # Should show >= 1.5.7

# Verify installed version
terraform version
# Terraform v1.8.5
# on linux_amd64
```

--------------------------------

### Variable Resolution Logic Example 1

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Demonstrates variable resolution when the item specifies a value for 'validation_method'. The item's value takes precedence.

```hcl
# Item configuration
items = {
  "api" = {
    domain_name = "api.example.com"
    validation_method = "EMAIL"  # Item override
  }
}

# Defaults
defaults = {
  validation_method = "DNS"  # Default value
}

# Resolution
try(each.value.validation_method, var.defaults.validation_method, null)
=> each.value.validation_method = "EMAIL" (item wins)
=> Result: "EMAIL"
```

--------------------------------

### Local Development Terraform Commands

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Commands for local development, including installing Terraform, initializing the project, checking formatting, validating the configuration, and planning changes before applying them.

```bash
# Install Terraform 1.8.5
terraform version

# Validate module
terraform init
terraform validate

# Format check
terraform fmt -recursive -check .

# Plan before apply
terraform plan

# Apply changes
terraform apply
```

--------------------------------

### ACM Key Algorithm Selection Guide

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

Provides a quick reference for selecting the `key_algorithm` based on use case. Recommends `null` (RSA_2048) for general use, `EC_prime256v1` for high security, and specific RSA options for compatibility or legacy systems.

```hcl
# For most use cases (recommended)
key_algorithm = null  # RSA_2048 - good security, universal compatibility

# For high-security requirements
key_algorithm = "EC_prime256v1"  # Modern, fast, secure

# For CloudFront (check current AWS support)
key_algorithm = "RSA_2048"  # Most compatible

# For internal services
key_algorithm = "EC_secp384r1"  # High security, excellent performance

# For legacy systems requiring RSA
key_algorithm = "RSA_2048"  # or "RSA_3072" for more security
```

--------------------------------

### Docker Terraform Installation

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Use a specific Terraform version in a Docker image for CI/CD pipelines. This ensures a consistent environment for Terraform runs.

```dockerfile
FROM hashicorp/terraform:1.8.5
# Module works in any recent Terraform image
```

--------------------------------

### Use Validation Domains with External DNS Provider

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

This example demonstrates integrating the `validation_domains` with an external DNS provider, specifically Cloudflare. It uses a `for_each` loop to create records based on the processed domain validation information.

```hcl
resource "cloudflare_record" "validation" {
  for_each = { for domain in module.acm.validation_domains :
    domain.resource_record_name => domain
  }
  
  name    = each.value.resource_record_name
  type    = each.value.resource_record_type
  value   = trimsuffix(each.value.resource_record_value, ".")
}
```

--------------------------------

### Variable Resolution Logic Example 3

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Illustrates variable resolution when neither the item nor 'defaults' specify a value, falling back to the module's built-in default.

```hcl
# Item configuration
items = {
  "api" = {
    domain_name = "api.example.com"
  }
}

# Defaults
defaults = {}  # Empty

# Resolution
try(each.value.validation_method, var.defaults.validation_method, null)
=> each.value.validation_method missing
=> var.defaults.validation_method missing
=> use module's built-in default
=> Result: module default (e.g., null)
```

--------------------------------

### Multi-Region Certificate Deployment

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Deploy the same certificate to multiple regions for disaster recovery or global distribution. This example demonstrates deploying a certificate to both `us-east-1` and `us-west-2`.

```hcl
module "acm_primary" {
  source = "terraform-aws-modules/acm/aws"
  
  providers = {
    aws = aws.us-east-1
  }
  
  region = "us-east-1"
  domain_name = "example.com"
}

module "acm_secondary" {
  source = "terraform-aws-modules/acm/aws"
  
  providers = {
    aws = aws.us-west-2
  }
  
  region = "us-west-2"
  domain_name = "example.com"
}
```

--------------------------------

### Example Items Structure for Certificates

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

This HCL structure demonstrates the expected format for the 'items' variable. Each key represents a certificate identifier (e.g., 'api', 'www'), and its value is a configuration object that can override default settings for that specific certificate.

```hcl
items = {
  "api" = {
    domain_name = "api.example.com"
    # other overrides
  }
  "www" = {
    domain_name = "www.example.com"
    subject_alternative_names = ["example.com"]
  }
}
```

--------------------------------

### External DNS Provider Integration

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/configuration.md

This example demonstrates integrating with an external DNS provider by disabling automatic Route 53 record creation and providing validation record hostnames manually.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  
  subject_alternative_names = ["*.example.com"]
  
  validation_method       = "DNS"
  create_route53_records  = false
  validation_record_fqdns = cloudflare_record.validation[*].hostname
}
```

--------------------------------

### AWS Provider Configuration Example

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Configure the AWS provider with a specific version constraint and region. The `~> 6.28` constraint ensures the latest 6.x release is used while preventing major version upgrades.

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.28"  # Use latest 6.x release
    }
  }
}

provider "aws" {
  region = "us-east-1"
}
```

--------------------------------

### Export Certificate using AWS CLI

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

Example of exporting a certificate using the AWS CLI when export is enabled. Requires specifying the certificate ARN and a passphrase file.

```bash
# Using AWS CLI
aws acm export-certificate \
  --certificate-arn arn:aws:acm:region:account:certificate/id \
  --passphrase fileb://path/to/passphrase.txt \
  --region us-east-1

# Output contains:
# - Certificate (PEM format)
# - CertificateChain (PEM format)
# - PrivateKey (encrypted)
```

--------------------------------

### Terragrunt Example: Multiple S3 Buckets

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/wrappers/README.md

This Terragrunt configuration manages multiple S3 buckets using the ACM module wrapper. It shows how to define default settings and specific configurations for each bucket.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/acm/aws//wrappers"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-acm.git//wrappers?ref=master"
}

inputs = {
  defaults = {
    force_destroy = true

    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}
```

--------------------------------

### Regional ACM Deployment Strategy

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

This example demonstrates the recommended strategy of deploying ACM certificates in the same AWS region where the associated resources will be used. It shows separate module configurations for certificates in `us-east-1` and `us-west-2`.

```hcl
# Certificate in same region as usage
module "acm_us_east" {
  region = "us-east-1"
  domain_name = "us-east.example.com"
}

module "acm_us_west" {
  region = "us-west-2"
  domain_name = "us-west.example.com"
}
```

--------------------------------

### Example ACM Validation Domain Computation

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

Illustrates the transformation of ACM domain validation options before and after processing by the `validation_domains` local value. It shows the removal of wildcard prefixes and deduplication.

```json
[
  {
    "domain_name": "*.example.com",
    "resource_record_name": "_689571ee9a5f9ec307c512c5d851e25a.example.com",
    "resource_record_type": "CNAME",
    "resource_record_value": "_689571ee9a5f9ec307c512c5d851e25a.acm-validations.aws."
  },
  {
    "domain_name": "*.example.com",
    "resource_record_name": "_689571ee9a5f9ec307c512c5d851e25a.example.com",
    "resource_record_type": "CNAME",
    "resource_record_value": "_689571ee9a5f9ec307c512c5d851e25a.acm-validations.aws."
  },
  {
    "domain_name": "api.example.com",
    "resource_record_name": "_689571ee9a5f9ec307c512c5d851e25a.example.com",
    "resource_record_type": "CNAME",
    "resource_record_value": "_689571ee9a5f9ec307c512c5d851e25a.acm-validations.aws."
  }
]

After processing:
[
  {
    "domain_name": "example.com",        # Normalized
    "resource_record_name": "_689571ee9a5f9ec307c512c5d851e25a.example.com",
    "resource_record_type": "CNAME",
    "resource_record_value": "_689571ee9a5f9ec307c512c5d851e25a.acm-validations.aws."
  },
  {
    "domain_name": "api.example.com",
    "resource_record_name": "_689571ee9a5f9ec307c512c5d851e25a.example.com",
    "resource_record_type": "CNAME",
    "resource_record_value": "_689571ee9a5f9ec307c512c5d851e25a.acm-validations.aws."
  }
]
```

--------------------------------

### Example Default Values Structure

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

This HCL structure illustrates the expected format for the 'defaults' variable. It includes common ACM configurations like validation method, zone ID, wait for validation, and tags, which can be applied to all certificates.

```hcl
defaults = {
  validation_method = "DNS"
  zone_id           = "Z2ES7B9AZ6SHAE"
  wait_for_validation = true
  tags = {
    ManagedBy  = "terraform"
    Module     = "acm"
  }
}
```

--------------------------------

### CI/CD Pipeline Steps for Certificate Creation and Deployment

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/common-scenarios.md

This bash script outlines the steps for a CI/CD pipeline: first, apply Terraform to create the infrastructure, then check the certificate status, and finally deploy when the certificate is issued.

```bash
# In pipeline step 1: Create infrastructure
terraform apply -auto-approve

# In pipeline step 2: Check certificate status
CERT_ARN=$(terraform output -raw certificate_arn)
aws acm describe-certificate --certificate-arn $CERT_ARN --query 'Certificate.Status'

# In pipeline step 3: Deploy when certificate is ISSUED
while true; do
  STATUS=$(aws acm describe-certificate --certificate-arn $CERT_ARN --query 'Certificate.Status' --output text)
  if [ "$STATUS" = "ISSUED" ]; then
    echo "Certificate is ready!"
    break
  fi
  sleep 10
done
```

--------------------------------

### Basic Multi-Certificate Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Demonstrates the basic usage of the ACM wrapper module to create multiple certificates with common default settings and individual domain names.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws//wrappers"

  defaults = {
    validation_method = "DNS"
    zone_id           = "Z2ES7B9AZ6SHAE"
    tags = {
      ManagedBy = "terraform"
    }
  }

  items = {
    "api" = {
      domain_name = "api.example.com"
    }
    "www" = {
      domain_name = "www.example.com"
    }
    "admin" = {
      domain_name = "admin.example.com"
    }
  }
}

# Export certificate ARNs
output "certificate_arns" {
  value = {
    api   = module.acm.wrapper["api"].acm_certificate_arn
    www   = module.acm.wrapper["www"].acm_certificate_arn
    admin = module.acm.wrapper["admin"].acm_certificate_arn
  }
}
```

--------------------------------

### Standard Certificate Creation with Locals

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

Demonstrates a standard scenario for creating an ACM certificate. Locals are evaluated based on the input variables.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"
  
  create_certificate = true
  domain_name = "example.com"
  zone_id = "Z2ES7B9AZ6SHAE"
}

# Locals evaluated as:
# create_certificate = true && true = true
# create_route53_records_only = false && true = false
# distinct_domain_names = ["example.com"]
# validation_domains = [{ domain_name = "example.com", ... }]
```

--------------------------------

### Wildcard and Root Domain Certificate

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/common-scenarios.md

Use this configuration to create a single certificate that covers both a root domain (e.g., example.com) and all its direct subdomains (e.g., *.example.com). This is useful for applications with multiple subdomains that need SSL/TLS encryption. The DNS validation method is recommended for this scenario.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"

  domain_name = "example.com"
  zone_id     = "Z2ES7B9AZ6SHAE"

  subject_alternative_names = [
    "*.example.com",
  ]

  validation_method = "DNS"

  tags = {
    Name = "wildcard-certificate"
  }
}

# Covers:
# - example.com (primary)
# - *.example.com (all direct subdomains)
# Valid for:
# - api.example.com ✓
# - www.example.com ✓
# - staging.api.example.com ✗ (nested subdomain)

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = 443
  protocol          = "HTTPS"
  certificate_arn   = module.acm.acm_certificate_arn

  default_action {
    type = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}
```

--------------------------------

### Override Distinct Domain Names

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

This HCL example shows how to override the `distinct_domain_names` local value by passing a precomputed list from another module. This is useful in split-provider configurations.

```hcl
module "route53_records" {
  create_certificate          = false
  create_route53_records_only = true
  
  # Provide precomputed domains from certificate module
  distinct_domain_names = module.acm.distinct_domain_names
}
```

--------------------------------

### Fast Non-Blocking Certificate Creation for CI/CD

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/common-scenarios.md

Use this configuration to create certificates quickly without waiting for DNS validation to complete, ideal for CI/CD pipelines. Set `wait_for_validation` to `false` to achieve this.

```hcl
variable "skip_validation_wait" {
  type    = bool
  default = true
  description = "Skip waiting for validation in CI/CD pipelines"
}

module "acm" {
  source = "terraform-aws-modules/acm/aws"

  domain_name = "app.example.com"
  zone_id     = "Z2ES7B9AZ6SHAE"

  validation_method = "DNS"

  wait_for_validation = !var.skip_validation_wait

  tags = {
    Name = "ci-cd-cert"
  }
}

output "certificate_arn" {
  value = module.acm.acm_certificate_arn
}

output "certificate_status" {
  value       = module.acm.acm_certificate_status
  description = "Check status - may be PENDING_VALIDATION initially"
}
```

--------------------------------

### ACM Module: Usage Pattern for Manual DNS Record Creation

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/outputs-reference.md

Shows how to use the `validation_domains` output to create DNS records manually, particularly when integrating with an external DNS provider. It normalizes wildcard domains and handles deduplication.

```hcl
locals {
  validation_records = {
    for domain in module.acm.validation_domains :
    domain.resource_record_name => {
      type  = domain.resource_record_type
      value = domain.resource_record_value
    }
  }
}

resource "aws_route53_record" "manual_validation" {
  for_each = local.validation_records
  
  zone_id = aws_route53_zone.example.id
  name    = each.key
  type    = each.value.type
  records = [trimsuffix(each.value.value, ".")]
  ttl     = 60
}
```

--------------------------------

### Inter-Module References with Split Providers

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/outputs-reference.md

Demonstrates how to reference outputs from one ACM module instance (for certificate creation) to another instance (for Route53 record creation) when using separate providers.

```hcl
module "acm_only" {
  source = "terraform-aws-modules/acm/aws"
  
  providers = {
    aws = aws.acm
  }
  
  domain_name = "example.com"
  create_route53_records = false
}

module "route53_only" {
  source = "terraform-aws-modules/acm/aws"
  
  providers = {
    aws = aws.route53
  }
  
  create_certificate          = false
  create_route53_records_only = true
  
  zone_id               = "Z2ES7B9AZ6SHAE"
  distinct_domain_names = module.acm_only.distinct_domain_names
  acm_certificate_domain_validation_options = module.acm_only.acm_certificate_domain_validation_options
}
```

--------------------------------

### Parent Terraform Provider Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

The parent Terraform code is responsible for configuring the AWS provider. This example shows a basic configuration for the `us-east-1` region, which the ACM module will then use.

```hcl
provider "aws" {
  region = "us-east-1"
}

module "acm" {
  source = "terraform-aws-modules/acm/aws"
  # Uses provider "aws" from parent context
}
```

--------------------------------

### Enable Certificate Creation in Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Explicitly set `create_certificate = true` within an item to ensure certificate creation is not gated by a conditional or default setting. This resolves issues where certificates are not created.

```hcl
items = {
  "api" = {
    domain_name     = "api.example.com"
    create_certificate = true  # Explicitly enable
  }
}
```

--------------------------------

### Get ACM Certificate Status Output

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/outputs-reference.md

Retrieve the current status of the ACM certificate. This is useful for monitoring validation progress or gating downstream resource creation in CI/CD pipelines.

```hcl
output "acm_certificate_status" {
  description = "Status of the certificate."
  value       = try(aws_acm_certificate.this[0].status, "")
}
```

--------------------------------

### Regional Certificate Creation for Non-CloudFront Use Cases

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

For use cases other than CloudFront, create ACM certificates in the specific AWS region where they will be utilized. This example shows creating a certificate in `us-west-2`.

```hcl
# ALB in us-west-2
provider "aws" {
  alias  = "us-west-2"
  region = "us-west-2"
}

module "acm" {
  source = "terraform-aws-modules/acm/aws"
  
  providers = {
    aws = aws.us-west-2
  }
  
  region = "us-west-2"
}
```

--------------------------------

### Deploy Multiple ACM Module Instances

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/resource-management.md

Demonstrates how to deploy multiple instances of the ACM module for different domains. Each instance uses the logical name 'this', allowing them to coexist without state conflicts.

```hcl
module "acm_staging" {
  source = "terraform-aws-modules/acm/aws"
  domain_name = "staging.example.com"
}

module "acm_production" {
  source = "terraform-aws-modules/acm/aws"
  domain_name = "example.com"
}

# Both can be deployed simultaneously
# Resource identifiers in state:
# - module.acm_staging.aws_acm_certificate.this[0]
# - module.acm_production.aws_acm_certificate.this[0]
```

--------------------------------

### Output All Certificate Details

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Create an output that aggregates detailed information for all certificates, including ARN, status, and domain names, using a map comprehension.

```hcl
output "certificate_details" {
  value = {
    for key, cert in module.acm.wrapper :
    key => {
      arn    = cert.acm_certificate_arn
      status = cert.acm_certificate_status
      domains = cert.distinct_domain_names
    }
  }
}
```

--------------------------------

### Certificate Creation Defaults

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/configuration.md

Configure automatic certificate creation and validation settings. Ensure Route53 records are managed if needed.

```hcl
create_certificate          = true   # Create the certificate
validate_certificate        = true   # Validate via Route53 or EMAIL
wait_for_validation         = true   # Wait for validation to complete
create_route53_records      = true   # Create Route53 records automatically
create_route53_records_only = false  # Not in Route53-only mode
```

--------------------------------

### Wrapper Module for Multiple Certificates

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/usage-patterns.md

Leverage the wrapper module to manage multiple certificates with shared default configurations. This pattern is ideal for organizations needing consistent certificate management across various services, allowing for concise creation and overriding defaults on a per-certificate basis.

```hcl
module "acm_wrapper" {
  source = "terraform-aws-modules/acm/aws//wrappers"

  defaults = {
    validation_method = "DNS"
    zone_id           = "Z2ES7B9AZ6SHAE"
    tags = {
      ManagedBy = "terraform"
    }
  }

  items = {
    "api" = {
      domain_name = "api.example.com"
      tags = {
        Service = "api"
      }
    }
    "www" = {
      domain_name = "www.example.com"
      subject_alternative_names = [
        "example.com",
      ]
      tags = {
        Service = "website"
      }
    }
    "admin" = {
      domain_name = "admin.example.com"
      tags = {
        Service = "administration"
      }
    }
  }
}

# Access individual certificates
output "api_certificate_arn" {
  value = module.acm_wrapper.wrapper["api"].acm_certificate_arn
}

output "www_certificate_arn" {
  value = module.acm_wrapper.wrapper["www"].acm_certificate_arn
}
```

--------------------------------

### Verify Item Exists in Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Ensure the certificate's key is present in the `items` map to avoid creation issues. This is crucial when troubleshooting missing certificates.

```hcl
items = {
  "api" = { ... }  # Ensure key is present
}
```

--------------------------------

### Configure ACM for Microservices Mesh Certificates

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

This pattern demonstrates using `for_each` to provision certificates for multiple microservices within a mesh. Each service gets a unique certificate from the specified private CA.

```hcl
variable "services" {
  type = list(string)
  default = ["auth", "api", "admin"]
}

module "acm_mesh_certs" {
  for_each = toset(var.services)
  
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "${each.value}.mesh.internal"
  
  private_authority_arn = aws_acm_pca_certificate_authority.mesh.arn
  validation_method = null
  certificate_transparency_logging_preference = false
}
```

--------------------------------

### Terraform Upgrade Path

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Steps to upgrade Terraform and validate module compatibility. Always run `terraform init -upgrade` after changing Terraform versions.

```bash
terraform version

terraform init -upgrade

terraform plan

terraform apply
```

--------------------------------

### Configure ACM Certificate with Key Algorithm

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

Demonstrates how to configure the `key_algorithm` variable for ACM certificates. Use `null` for the AWS default (RSA_2048), or specify modern ECDSA or strong RSA algorithms.

```hcl
module "acm_default" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  key_algorithm = null  # Use RSA_2048
}

# Use modern ECDSA (recommended)
module "acm_ecdsa" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  key_algorithm = "EC_prime256v1"  # ECDSA P-256
}

# Use strong RSA (legacy compatibility)
module "acm_rsa4k" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  key_algorithm = "RSA_4096"  # 4096-bit RSA
}
```

--------------------------------

### Verify ACM Validation Email Sending

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/outputs-reference.md

A usage pattern to confirm that ACM has sent validation emails. This example uses a `null_resource` with `local-exec` to echo the list of email addresses that received the validation emails.

```hcl
resource "null_resource" "validation_email_check" {
  provisioner "local-exec" {
    command = "echo 'Validation emails sent to: ${join(", ", module.acm.acm_certificate_validation_emails)}'"
  }
}
```

--------------------------------

### Environment-Specific Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Illustrates how to dynamically configure ACM certificates based on an environment variable, using a map to define defaults for different environments (development, staging, production).

```hcl
variable "environment" {
  type    = string
  default = "production"
}

locals {
  defaults_by_env = {
    development = {
      validation_method       = "DNS"
      wait_for_validation     = false  # Faster in dev
      zone_id                 = data.aws_route53_zone.dev.zone_id
      tags = { Environment = "development" }
    }
    staging = {
      validation_method       = "DNS"
      wait_for_validation     = true
      zone_id                 = data.aws_route53_zone.staging.zone_id
      tags = { Environment = "staging" }
    }
    production = {
      validation_method       = "DNS"
      wait_for_validation     = true
      zone_id                 = data.aws_route53_zone.prod.zone_id
      tags = { Environment = "production" }
    }
  }

  items = {
    "api" = {
      domain_name = "api.${local.domain}"
    }
    "www" = {
      domain_name = "www.${local.domain}"
    }
  }
}

module "acm" {
  source = "terraform-aws-modules/acm/aws//wrappers"

  defaults = local.defaults_by_env[var.environment]
  items    = local.items
}
```

--------------------------------

### ACM Module Overriding Provider Region

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

This example shows a scenario where the AWS provider is configured for one region (`us-west-2`), but the ACM module is explicitly set to create a certificate in a different region (`us-east-1`). This is useful for specific service requirements.

```hcl
provider "aws" {
  region = "us-west-2"
}

module "acm_east" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  region = "us-east-1"  # Override to us-east-1 (for CloudFront)
}
```

--------------------------------

### Manage Many Certificates with Wrapper Module

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Employ the ACM wrapper module for managing a large number of certificates efficiently. It uses `defaults` and `items` to reduce repetition (DRY principle).

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws//wrappers"
  defaults = { zone_id = "Z..." }
  items = {
    "api" = { domain_name = "api.example.com" }
    "www" = { domain_name = "www.example.com" }
  }
}
```

--------------------------------

### Get ACM Certificate ARN Output

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/outputs-reference.md

Use this output to reference the issued certificate's ARN in other AWS resources like Load Balancers or CloudFront distributions. It attempts to retrieve the ARN from the validation resource first, falling back to the certificate resource ARN.

```hcl
output "acm_certificate_arn" {
  description = "The ARN of the certificate"
  value       = try(aws_acm_certificate_validation.this[0].certificate_arn, aws_acm_certificate.this[0].arn, "")
}
```

```hcl
resource "aws_lb" "example" {
  # ... lb configuration ...
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.example.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn   = module.acm.acm_certificate_arn
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}
```

--------------------------------

### Check ACM Supported Algorithms in Region

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/special-features.md

Shows how to use the AWS CLI to list supported key algorithms for ACM certificates in a specific region. This is useful for verifying regional availability.

```bash
# List supported algorithms in specific region
aws acm describe-certificate \
  --certificate-arn arn:... \
  --region us-east-1
```

--------------------------------

### Cross-Account Route53 Validation Records (Account B)

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/common-scenarios.md

This snippet shows how to create only the Route53 validation records in Account B, using outputs from Account A. The 'route53' provider must be configured with the correct role ARN for Account B. This setup separates concerns for certificate management and DNS record creation.

```hcl
provider "aws" {
  alias = "route53"
  assume_role {
    role_arn = "arn:aws:iam::ACCOUNT-B:role/TerraformRole"
  }
}

module "route53_records" {
  source = "terraform-aws-modules/acm/aws"

  providers = {
    aws = aws.route53
  }

  create_certificate          = false
  create_route53_records_only = true

  validation_method = "DNS"

  zone_id               = data.aws_route53_zone.example.zone_id
  distinct_domain_names = var.distinct_domain_names

  acm_certificate_domain_validation_options = var.domain_validation_options
}

# Pass outputs from Account A via Terraform Remote State or variables
variable "distinct_domain_names" {
  type = list(string)
}

variable "domain_validation_options" {
  type = any
}
```

--------------------------------

### Simple ACM Certificate Creation

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/README.md

This snippet demonstrates the basic configuration for creating an ACM certificate using the module. It requires specifying the domain name, zone ID, and validation method.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"
  
  domain_name = "example.com"
  zone_id     = "Z2ES7B9AZ6SHAE"
  
  validation_method = "DNS"
}

output "certificate_arn" {
  value = module.acm.acm_certificate_arn
}
```

--------------------------------

### AWS Provider Version Constraint Patterns

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/terraform-requirements.md

Illustrates different ways to specify version constraints for the AWS provider. Choose the pattern that best suits your project's stability and update strategy.

```hcl
# Allow any 6.28+ version (recommended for stability)
version = ">= 6.28"

# Allow latest 6.x release, prevent major version bump
version = "~> 6.28"

# Specific version pinning
version = "= 6.40"

# Allow specific version range
version = ">= 6.28, < 7.0"
```

--------------------------------

### Instantiate Wrapper Module with for_each

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

This HCL code demonstrates how to use the wrapper module with Terraform's for_each meta-argument. It iterates over a variable named 'items' to create multiple instances of the base ACM module, passing each item's values and merging them with defaults.

```hcl
# wrappers/main.tf
module "wrapper" {
  source = "../"
  
  for_each = var.items
  
  # Pass each item's values to the base module
  acm_certificate_domain_validation_options   = try(each.value.acm_certificate_domain_validation_options, var.defaults.acm_certificate_domain_validation_options, {})
  certificate_transparency_logging_preference = try(each.value.certificate_transparency_logging_preference, var.defaults.certificate_transparency_logging_preference, true)
  # ... all other variables ...
}
```

--------------------------------

### Wrapper Output Definition

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Defines the 'wrapper' output for the module, which is a map of all certificate module outputs.

```hcl
output "wrapper" {
  description = "Map of outputs of a wrapper."
  value       = module.wrapper
}
```

--------------------------------

### Disabled Certificate Creation with Specific Local

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

Shows a scenario where certificate creation is explicitly disabled by setting `putin_khuylo` to false, which indirectly affects other locals. This results in no certificate being created and an empty validation_domains list.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"
  
  create_certificate = true
  putin_khuylo = false
  domain_name = "example.com"
}

# Locals evaluated as:
# create_certificate = true && false = false
# create_route53_records_only = false && false = false
# distinct_domain_names = ["example.com"] (computed anyway)
# validation_domains = [] (no certificate, so empty)
```

--------------------------------

### Conditionally Create Certificate

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/usage-patterns.md

Use this pattern to create a certificate only when specific conditions are met, such as in a production environment. The `create_certificate` argument controls the creation process, and an empty ARN is returned if the certificate is not created.

```hcl
variable "environment" {
  type    = string
  default = "development"
}

variable "enable_https" {
  type    = bool
  default = true
}

module "acm" {
  source  = "terraform-aws-modules/acm/aws"
  version = "~> 4.0"

  # Only create certificate in production
  create_certificate = var.environment == "production" && var.enable_https

  domain_name = "example.com"
  zone_id     = "Z2ES7B9AZ6SHAE"

  validation_method = "DNS"

  tags = {
    Name        = "conditional-cert"
    Environment = var.environment
  }
}

output "certificate_arn" {
  value       = try(module.acm.acm_certificate_arn, "")
  description = "Certificate ARN if created, empty string otherwise"
}
```

--------------------------------

### Certificate Options Defaults

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/configuration.md

Define options for the certificate's key algorithm, exportability, transparency logging, and region.

```hcl
key_algorithm                       = null  # Use AWS default (RSA_2048)
export                              = null  # Export disabled
certificate_transparency_logging_preference = true
private_authority_arn               = null  # Use Amazon-issued certs
region                              = null  # Use provider's region
```

--------------------------------

### Create a Simple Single Domain Certificate

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/INDEX.md

Use this snippet to create a basic DNS-validated certificate for a single domain. Ensure you have a Route 53 hosted zone or can manage DNS records externally.

```hcl
module "acm" {
  source = "terraform-aws-modules/acm/aws"
  domain_name = "example.com"
  zone_id = "Z..."
  validation_method = "DNS"
}
```

--------------------------------

### Document Complex Certificate Configurations

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/wrapper-module.md

Add comments to explain non-obvious configuration choices, such as differing validation timeouts for certificates based on their importance or priority.

```hcl
# Good - Comments explain non-obvious choices
items = {
  "api" = {
    domain_name = "api.example.com"
    # High value service - more restrictive validation
    validation_timeout = "30m"
  }
  "cdn" = {
    domain_name = "cdn.example.com"
    # Low priority - faster timeout acceptable
    validation_timeout = "10m"
  }
}
```

--------------------------------

### Cross-Account Certificate Creation (Account A)

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/common-scenarios.md

This snippet demonstrates creating an ACM certificate in Account A. Route53 records are not created here, as they will be managed in a separate account. Ensure the 'acm' provider is configured with the correct role ARN for Account A.

```hcl
provider "aws" {
  alias = "acm"
  assume_role {
    role_arn = "arn:aws:iam::ACCOUNT-A:role/TerraformRole"
  }
}

module "acm" {
  source = "terraform-aws-modules/acm/aws"

  providers = {
    aws = aws.acm
  }

  domain_name = "app.example.com"

  create_route53_records = false  # Records managed elsewhere
  validation_method      = "DNS"

  tags = {
    Name = "cross-account-cert"
  }
}

output "distinct_domain_names" {
  value = module.acm.distinct_domain_names
}

output "domain_validation_options" {
  value = module.acm.acm_certificate_domain_validation_options
}

output "certificate_arn" {
  value = module.acm.acm_certificate_arn
}
```

--------------------------------

### Define create_certificate Local

Source: https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/_autodocs/local-values.md

This local value gates the creation of ACM certificates. It requires both the user to explicitly request certificate creation and a political agreement flag to be true. Use this when you need to conditionally create certificates based on multiple criteria.

```hcl
create_certificate = var.create_certificate && var.putin_khuylo
```