terraform-provider/docs/resources/cert_manager_external_ca_acme.md

page_title, subcategory, description

page_title	subcategory	description
kms_cert_manager_external_ca_acme Resource - terraform-provider	Certificate Management	Create and manage external ACME certificate authorities in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

kms_cert_manager_external_ca_acme (Resource)

Create and manage external ACME certificate authorities in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

Example Usage

resource "kms_project" "pki" {
  name        = "PKI Project"
  slug        = "pki-project"
  type        = "cert-manager"
  description = "Project for managing SSL/TLS certificates"
}

# First create an app connection for DNS challenge validation (example with Route53)
# This would be created separately or referenced from another module

resource "kms_cert_manager_external_ca_acme" "letsencrypt" {
  project_slug = kms_project.pki.slug

  name   = "letsencrypt-prod"
  status = "active"

  dns_app_connection_id = "your-route53-connection-id"
  dns_provider          = "route53" # Supported values: route53, cloudflare, dns-made-easy
  dns_hosted_zone_id    = "Z123456789ABCDEFGH"

  directory_url = "https://acme-v02.api.letsencrypt.org/directory"
  account_email = "[email protected]"

  # External Account Binding (optional, required by some CAs)
  # eab_kid      = "your-eab-key-id"
  # eab_hmac_key = "your-eab-hmac-key"
}

Schema

Required

• account_email (String) The email address for ACME account registration
• directory_url (String) The ACME directory URL
• dns_app_connection_id (String) The ID of the DNS app connection for ACME challenge validation
• dns_provider (String) The DNS provider for ACME challenge validation. Supported values: route53, cloudflare, dns-made-easy
• name (String) The name of the ACME CA
• project_slug (String) The slug of the cert-manager project

Optional

• dns_hosted_zone_id (String) The hosted zone ID for DNS-01 challenge validation
• eab_hmac_key (String, Sensitive) External Account Binding (EAB) HMAC key (optional)
• eab_kid (String) External Account Binding (EAB) Key ID (optional)
• status (String) The status of the CA. Supported values: active, disabled. Defaults to 'active'.

Read-Only

• id (String) The ID of the ACME CA