(aws-certificatemanager): add L2 construct for ACME certificate issuance

[somesh-1696]

Describe the feature

aws-cdk-lib/aws-certificatemanager provides L2 constructs for ACM (Certificate, CertificateValidation, etc.), but there is no construct for the ACME protocol.

Use Case

Many teams want to use ACME certificates instead of, or alongside, ACM-issued certificates.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

^2.265.0

AWS CDK CLI version

2.1134.0

Environment details (OS name and version, etc.)

NA

[pahud]

Thanks for the feature request! I verified this against the published aws-cdk-lib package: while there's no L2 yet, the good news is that the L1 constructs are already available — CfnAcmeEndpoint and CfnAcmeExternalAccountBinding have been auto-generated into aws-cdk-lib/aws-certificatemanager since at least v2.263.0, so on your ^2.265.0 you can use them today:

import { CfnAcmeEndpoint } from 'aws-cdk-lib/aws-certificatemanager';

new CfnAcmeEndpoint(this, 'AcmeEndpoint', {
  authorizationBehavior: 'EXTERNAL_ACCOUNT_BINDING_REQUIRED',
  certificateAuthority: {
    publicCertificateAuthority: {
      allowedKeyAlgorithms: ['EC_prime256v1'],
    },
  },
  contact: 'mailto:pki-team@example.com',
});

One scoping note: from my view, an L2 here would cover the ACME endpoint (the governance piece), not certificate issuance itself. Per the ACM docs, certificates are issued at runtime by ACMEv2 clients (Certbot, cert-manager, acme.sh) — CloudFormation isn't in that path, private keys stay client-side, and ACME-issued certificates can't be bound to ELB/CloudFront/API Gateway.

To help shape the L2 API, could you share a bit more about your use case?

• Which pieces matter most: endpoint creation, External Account Binding management, IAM role binding for ACME accounts, domain scoping?
• Does the L1 escape hatch above unblock you in the meantime?

Marking this as p2. If you'd like to take a shot at the L2 design, we'd welcome a contribution — an RFC-style API sketch in this issue would be a great starting point!

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.