Use the new Terraform module to create ACM certificates

.gitignore

@@ -6,3 +6,6 @@ node_modules/
 
 # JetBrains IDEs
 .idea
+
+# Terraform
+*.plan

infrastructure/api_stack/api_gateway.tf

@@ -7,8 +7,8 @@ resource "aws_api_gateway_rest_api" "content" {
 }
 
 resource "aws_api_gateway_domain_name" "content_api" {
-  domain_name              = aws_acm_certificate.content_api.domain_name
-  regional_certificate_arn = aws_acm_certificate_validation.content.certificate_arn
+  domain_name              = local.cert_domain_name
+  regional_certificate_arn = module.cert.arn
   security_policy          = "TLS_1_2"
 
   endpoint_configuration {

infrastructure/api_stack/certificate.tf

@@ -1,39 +1,23 @@
-resource "aws_acm_certificate" "content_api" {
+locals {
   // This is not the same as the external hostname!
   // It should correspond to the origin domains in the CloudFront distribution:
   // https://github.com/wellcomecollection/platform-infrastructure/blob/main/cloudfront/api.wellcomecollection.org/main.tf
-  domain_name       = "content.api-${var.environment}.wellcomecollection.org"
-  validation_method = "DNS"
+  cert_domain_name = "content.api-${var.environment}.wellcomecollection.org"
+}
+
+module "cert" {
+  source = "github.com/wellcomecollection/terraform-aws-acm-certificate?ref=v1.0.0"
+
+  domain_name = local.cert_domain_name
 
-  lifecycle {
-    create_before_destroy = true
+  zone_id = data.aws_route53_zone.dotorg.id
+
+  providers = {
+    aws.dns = aws.dns
   }
 }
 
 data "aws_route53_zone" "dotorg" {
   provider = aws.dns
   name     = "wellcomecollection.org."
 }
-
-resource "aws_route53_record" "content_certificate_validation" {
-  provider = aws.dns
-  for_each = {
-    for dvo in aws_acm_certificate.content_api.domain_validation_options : dvo.domain_name => {
-      name   = dvo.resource_record_name
-      record = dvo.resource_record_value
-      type   = dvo.resource_record_type
-    }
-  }
-
-  allow_overwrite = true
-  name            = each.value.name
-  records         = [each.value.record]
-  ttl             = 60
-  type            = each.value.type
-  zone_id         = data.aws_route53_zone.dotorg.zone_id
-}
-
-resource "aws_acm_certificate_validation" "content" {
-  certificate_arn         = aws_acm_certificate.content_api.arn
-  validation_record_fqdns = [for record in aws_route53_record.content_certificate_validation : record.fqdn]
-}