cdk-library-certbot
A CDK Construct Library to automate the creation and renewal of Let's Encrypt certificates.
Features
- Creates a lambda function that utilizes Certbot to request a certificate from Let's Encrypt
- Uploads the resulting certificate data to S3 for later retrieval
- Imports the certificate to AWS Certificate Manager for tracking expiration
- Creates a trigger to re-run and re-new if the cert will expire in the next 30 days (customizable)
API Doc
See API
References
Original [gist](# Modified from original gist https://gist.github.com/arkadiyt/5d764c32baa43fc486ca16cb8488169a) that was modified for the Lambda code
Examples
This construct utilizes a Route 53 hosted zone lookup so it will require that your stack has [environment variables set for account and region](See https://docs.aws.amazon.com/cdk/latest/guide/environments.html for more details.).
Typescript
Typescript with Default Setup
import * as cdk from '@aws-cdk/core';
import { Certbot } from '@renovosolutions/cdk-library-certbot';
import { Architecture } from '@aws-cdk/aws-lambda';
export class CdkExampleCertsStack extends cdk.Stack {
constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
let domains = [
'example.com',
'www.example.com'
]
new Certbot(this, 'cert', {
letsencryptDomains: domains.join(','),
letsencryptEmail: 'webmaster+letsencrypt@example.com',
hostedZoneNames: [
'example.com'
]
})
}
}
Typescript with alternate storage location (Secrets Manager)
import * as cdk from '@aws-cdk/core';
import { Certbot, CertificateStorageType } from '@renovosolutions/cdk-library-certbot';
import { Architecture } from '@aws-cdk/aws-lambda';
export class CdkExampleCertsStack extends cdk.Stack {
constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
let domains = [
'example.com',
'www.example.com'
]
new Certbot(this, 'cert', {
letsencryptDomains: domains.join(','),
letsencryptEmail: 'webmaster+letsencrypt@example.com',
hostedZoneNames: [
'example.com'
]
certificateStorage: CertificateStorageType.SECRETS_MANAGER
// Optional path
secretsManagerPath: '/path/to/secret/'
})
}
}
Typescript with alternate storage location (Parameter Store)
import * as cdk from '@aws-cdk/core';
import { Certbot, CertificateStorageType } from '@renovosolutions/cdk-library-certbot';
import { Architecture } from '@aws-cdk/aws-lambda';
export class CdkExampleCertsStack extends cdk.Stack {
constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
let domains = [
'example.com',
'www.example.com'
]
new Certbot(this, 'cert', {
letsencryptDomains: domains.join(','),
letsencryptEmail: 'webmaster+letsencrypt@example.com',
hostedZoneNames: [
'example.com'
]
certificateStorage: CertificateStorageType.SSM_SECURE
// Optional path
ssmSecurePath: '/path/to/secret/'
})
}
}
Typescript with zone creation in the same stack
import * as cdk from '@aws-cdk/core';
import * as route53 from '@aws-cdk/aws_route53';
import { Certbot } from '@renovosolutions/cdk-library-certbot';
import { Architecture } from '@aws-cdk/aws-lambda';
export class CdkExampleCertsStack extends cdk.Stack {
constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const hostedZone = new r53.HostedZone(this, 'authZone', {
zoneName: 'auth.example.com',
});
let domains = [
'example.com',
'www.example.com',
'auth.example.com'
]
new Certbot(this, 'cert', {
letsencryptDomains: domains.join(','),
letsencryptEmail: 'webmaster+letsencrypt@example.com',
hostedZoneNames: [
'example.com'
],
hostedZones: [
hostedZone,
]
})
}
}
Python
from aws_cdk import (
core as cdk
)
from certbot import Certbot
class CdkExampleCertsStack(cdk.Stack):
def __init__(self, scope: cdk.Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)
Certbot(self, "certbot",
letsencrypt_email="webmaster+letsencrypt@example.com",
letsencrypt_domains="example.com",
hosted_zone_names=["example.com"]
)
Testing the handler in this project
- Set up a python virtual env with
python3.10 -m venv .venv - Use the virtual env with
source .venv/bin/activate - Install dependencies with
pip install -r function/tests/requirements.txt - Run
pytest -v
The testing using moto to mock AWS services and verify the function does what is expected for each given storage type.
1 maintainer
Metadata
1 maintainer
Release files for renovosolutions.aws-cdk-certbot 2.9.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| renovosolutions_aws_cdk_certbot-2.9.2.tar.gz | 52.7 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| renovosolutions_aws_cdk_certbot-2.9.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 105.3 MB
Release files / renovosolutions_aws_cdk_certbot-2.9.2.tar.gz
| Download URL | renovosolutions_aws_cdk_certbot-2.9.2.tar.gz |
|---|---|
| Size | 52.7 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
95d83bb9b79b3bbbab68ddb4a39e07edaad32e3dde1e20483cf03a437edf7b97
|
|
BLAKE2b-256 checksum How to use checksums |
0f3014ded1db54c9e76ac89c3b21c39d69aadf50755b20feecea9ec84ab85fde
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.0.0 CPython/3.12.3
|
Release files / renovosolutions_aws_cdk_certbot-2.9.2-py3-none-any.whl
| Download URL | renovosolutions_aws_cdk_certbot-2.9.2-py3-none-any.whl |
|---|---|
| Size | 52.7 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
10952190e4a600b2e6092f312bef19e7513143a52e3669ad2ae497ef40ea1e0f
|
|
BLAKE2b-256 checksum How to use checksums |
d712d1dfe471260abf8d3224f1f6f06c9e366285145a76ff4550a2c923d5d355
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.0.0 CPython/3.12.3
|
