@trautonen/cdk-dns-validated-certificate 0.0.52 → 0.1.0

package/README.md

@@ -1,10 +1,11 @@
 # AWS CDK DNS Validated Certificate
 
-CDK does not have a built in construct to manage cross-region or cross-account DNS validated certificates. There's an attempt to work around the issue with a cross region references option for stacks, but it has a lot of issues and still does not solve the cross-account use case.
+CDK does not have a built in construct to manage cross-region or cross-account DNS validated certificates. There's an
+attempt to work around the issue with a cross region references option for stacks, but it has a lot of issues and still
+does not solve the cross-account use case.
 
-This construct solves these problems by managing the certificate as a custom resource and with direct API calls to ACM and Route53. In the future it will be possible to support not only Route53, but other DNS services too.
-
-Currently there's a limitation which does not allow using alternative names for the certificate as it would require mapping of different roles to different hosted zones. This API is currently being developed.
+This construct solves these problems by managing the certificate as a custom resource and with direct API calls to ACM
+and Route53. In the future it will be possible to support not only Route53, but other DNS services too.
 
 ## Usage for cross-region validation
 
@@ -38,3 +39,29 @@ const certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate',
   validationExternalId: externalId,
 })
 ```
+
+## Usage for cross-account alternative names validation
+
+```typescript
+// example.com is validated on same account against managed hosted zone
+// and secondary.com is validated against external hosted zone on other account
+const hostedZoneForMain: route53.IHostedZone = ...
+const hostedZoneForAlternative: route53.IHostedZone =
+  route53.HostedZone.fromHostedZoneAttributes(this, 'SecondaryHostedZone', {
+  hostedZoneId: 'Z532DGDEDFS123456789',
+  zoneName: 'secondary.com'
+})
+const certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {
+  domainName: 'example.com',
+  alternativeDomainNames: ['secondary.com'],
+  validationHostedZones: [{
+    hostedZone: hostedZoneForMain
+  },{
+    hostedZone: hostedZoneForAlternative,
+    validationRole: iam.Role.fromRoleArn(
+      this, 'SecondaryValidationRole', 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'
+    ),
+    validationExternalId: 'domain-assume'
+  }]
+})
+```

package/assets/certificate-requestor.lambda/index.js

@@ -51,6 +51,30 @@ var containsSame = (array1, array2) => {
     return false;
   return array1.every((v1) => array2.includes(v1));
 };
+var orderBySignificance = (domains) => {
+  const copy = [...domains];
+  copy.sort((a, b) => {
+    const ac = a.split(".").length;
+    const bc = b.split(".").length;
+    if (ac > bc) {
+      return -1;
+    }
+    if (ac < bc) {
+      return 1;
+    }
+    return 0;
+  });
+  return copy;
+};
+var cleanDomainName = (domainName) => {
+  if (domainName.endsWith(".")) {
+    return domainName.slice(0, -1);
+  }
+  return domainName;
+};
+var cleanChangeId = (changeId) => {
+  return changeId.replace("/change/", "");
+};
 var tryFor = async (maxSeconds, timeoutError, fn) => {
   const startTime = Date.now();
   for (let i = 0; true; i++) {
@@ -99,21 +123,52 @@ var changeRecordSets = async (route53, action, records, hostedZoneId) => {
       }))
     }
   };
-  const { ChangeInfo } = await route53.send(new import_client_route_53.ChangeResourceRecordSetsCommand(changeRecordSetsInput));
-  const result = await (0, import_client_route_53.waitUntilResourceRecordSetsChanged)({ client: route53, maxWaitTime: 180 }, { Id: ChangeInfo?.Id });
-  if (result.state !== "SUCCESS") {
-    throw new Error(
-      `Record sets never changed for hosted zone ${hostedZoneId}: [${result.state}] ${result.reason ?? ""}`
-    );
+  try {
+    const { ChangeInfo } = await route53.send(new import_client_route_53.ChangeResourceRecordSetsCommand(changeRecordSetsInput));
+    const changeId = ChangeInfo?.Id;
+    const result = await (0, import_client_route_53.waitUntilResourceRecordSetsChanged)({ client: route53, maxWaitTime: 180 }, { Id: changeId });
+    if (result.state !== "SUCCESS") {
+      throw new Error(
+        `Validation records never changed for hosted zone ${hostedZoneId}: [${result.state}] ${result.reason ?? ""}`
+      );
+    }
+    const operation = action === "CREATE" || action === "UPSERT" ? "changed" : "deleted";
+    const change = cleanChangeId(changeId);
+    console.log(`Validation records succesfully ${operation} for hosted zone ${hostedZoneId} with change id ${change}`);
+  } catch (error) {
+    if (action === "DELETE" && error instanceof import_client_route_53.InvalidChangeBatch && error.message.includes("not found")) {
+      console.log(`All validation records have already been removed by some other certificate`);
+    } else {
+      throw error;
+    }
   }
-  return ChangeInfo?.Id;
+};
+var getRecordsForZoneNames = (records, zoneNames, result) => {
+  const [zoneName, ...restZoneNames] = zoneNames;
+  if (!zoneName) {
+    return result ?? {};
+  }
+  const matchingRecords = [];
+  const unmatchingRecords = [];
+  for (const record of records) {
+    const normalizedRecordName = cleanDomainName(record.Name);
+    if (normalizedRecordName.endsWith(zoneName)) {
+      matchingRecords.push(record);
+    } else {
+      unmatchingRecords.push(record);
+    }
+  }
+  return getRecordsForZoneNames(unmatchingRecords, restZoneNames, {
+    ...result ?? {},
+    [zoneName]: matchingRecords
+  });
 };
 var requestCertificate = async (acm, route53, requestId, properties) => {
-  const { HostedZoneId, DomainName, SubjectAlternativeNames, TransparencyLoggingEnabled } = properties;
+  const { DomainName, AlternativeDomainNames, TransparencyLoggingEnabled } = properties;
   console.log(`Requesting certificate for ${DomainName}`);
   const requestCertificateInput = {
     DomainName,
-    SubjectAlternativeNames,
+    SubjectAlternativeNames: AlternativeDomainNames,
     IdempotencyToken: crypto.createHash("sha256").update(requestId).digest("hex").slice(0, 32),
     ValidationMethod: "DNS",
     Options: {
@@ -131,12 +186,29 @@ var requestCertificate = async (acm, route53, requestId, properties) => {
     const { Certificate } = await acm.send(new import_client_acm.DescribeCertificateCommand(describeCertificateInput));
     return parseDomainValidationRecords(Certificate);
   });
-  console.log(`Upserting ${validationRecords.length} validation record(s) into hosted zone ${HostedZoneId}:`);
+  const hostedZones = Object.values(properties.ValidationHostedZones);
+  const hostedZoneIds = hostedZones.map((zone) => zone.HostedZoneId);
+  console.log(
+    `Upserting ${validationRecords.length} validation record(s) into hosted zone(s) ${hostedZoneIds.join(", ")}:`
+  );
   validationRecords.forEach(
     (record) => console.log(`${record.Name} ${record.Type} ${record.ResourceRecords?.map((rr) => rr.Value).join(",")}`)
   );
-  const changeId = await changeRecordSets(route53, "UPSERT", validationRecords, HostedZoneId);
-  console.log(`All validation records changed succesfully for change id ${changeId.replace("/change/", "")}`);
+  const recordsForZoneNames = getRecordsForZoneNames(
+    validationRecords,
+    orderBySignificance(Object.keys(properties.ValidationHostedZones))
+  );
+  for (const hostedZone of hostedZones) {
+    const records = recordsForZoneNames[hostedZone.DomainName];
+    if (records.length > 0) {
+      await changeRecordSets(
+        route53(hostedZone.ValidationRoleArn, hostedZone.ValidationExternalId),
+        "UPSERT",
+        records,
+        hostedZone.HostedZoneId
+      );
+    }
+  }
   console.log(`Waiting for certificate ${CertificateArn} to validate`);
   const result = await (0, import_client_acm.waitUntilCertificateValidated)({ client: acm, maxWaitTime: 300 }, { CertificateArn });
   if (result.state !== "SUCCESS") {
@@ -145,7 +217,7 @@ var requestCertificate = async (acm, route53, requestId, properties) => {
   console.log(`Certificate ${CertificateArn} successfully validated`);
   return CertificateArn;
 };
-var deleteCertificate = async (acm, route53, certificateArn, hostedZoneId, cleanupValidationRecords) => {
+var deleteCertificate = async (acm, route53, certificateArn, properties) => {
   console.log(`Waiting for certificate ${certificateArn} usage to drain before deletion`);
   const waitUsageMaxSeconds = 600;
   const waitUsageTimeoutError = `Certificate was still in use after ${waitUsageMaxSeconds} seconds`;
@@ -162,16 +234,25 @@ var deleteCertificate = async (acm, route53, certificateArn, hostedZoneId, clean
   });
   console.log("Certificate is unused and will be deleted");
   const validationRecords = parseDomainValidationRecords(certificate);
-  if (validationRecords && cleanupValidationRecords) {
-    console.log(`Deleting ${validationRecords.length} validation record(s) from hosted zone ${hostedZoneId}`);
-    try {
-      const changeId = await changeRecordSets(route53, "DELETE", validationRecords, hostedZoneId);
-      console.log(`All validation records removed successfully for change id ${changeId.replace("/change/", "")}`);
-    } catch (error) {
-      if (error instanceof import_client_route_53.InvalidChangeBatch && error.message.includes("not found")) {
-        console.log(`All validation records have already been removed by some other certificate`);
-      } else {
-        throw error;
+  if (validationRecords && stringToBoolean(properties.CleanupValidationRecords)) {
+    const hostedZones = Object.values(properties.ValidationHostedZones);
+    const hostedZoneIds = hostedZones.map((zone) => zone.HostedZoneId);
+    console.log(
+      `Deleting ${validationRecords.length} validation record(s) from hosted zone(s) ${hostedZoneIds.join(", ")}`
+    );
+    const recordsForZoneNames = getRecordsForZoneNames(
+      validationRecords,
+      orderBySignificance(Object.keys(properties.ValidationHostedZones))
+    );
+    for (const hostedZone of hostedZones) {
+      const records = recordsForZoneNames[hostedZone.DomainName];
+      if (records.length > 0) {
+        await changeRecordSets(
+          route53(hostedZone.ValidationRoleArn, hostedZone.ValidationExternalId),
+          "DELETE",
+          records,
+          hostedZone.HostedZoneId
+        );
       }
     }
   }
@@ -193,13 +274,15 @@ var addTags = async (acm, certificateArn, tags) => {
   console.log(`All tags successfully added to certificate ${certificateArn}`);
 };
 var shouldRequestNew = (oldProperties, newProperties) => {
-  if (oldProperties.HostedZoneId !== newProperties.HostedZoneId)
+  const oldHostedZoneIds = Object.values(oldProperties.ValidationHostedZones ?? {}).map((zone) => zone.HostedZoneId);
+  const newHostedZoneIds = Object.values(newProperties.ValidationHostedZones ?? {}).map((zone) => zone.HostedZoneId);
+  if (!containsSame(oldHostedZoneIds, newHostedZoneIds))
     return true;
   if (oldProperties.DomainName !== newProperties.DomainName)
     return true;
-  if (oldProperties.CertificateRegion !== newProperties.CertificateRegion)
+  if (!containsSame(oldProperties.AlternativeDomainNames ?? [], newProperties.AlternativeDomainNames ?? []))
     return true;
-  if (!containsSame(oldProperties.SubjectAlternativeNames ?? [], newProperties.SubjectAlternativeNames ?? []))
+  if (oldProperties.CertificateRegion !== newProperties.CertificateRegion)
     return true;
   if (oldProperties.CleanupValidationRecords !== newProperties.CleanupValidationRecords)
     return true;
@@ -232,10 +315,12 @@ var assumeRole = (roleArn, externalId) => {
 var handler = async (event) => {
   const properties = parseProperties(event.ResourceProperties);
   const acm = new import_client_acm.ACMClient({ region: properties.CertificateRegion, retryMode: "adaptive" });
-  const route53 = new import_client_route_53.Route53Client({
-    retryMode: "adaptive",
-    credentials: assumeRole(properties.ValidationRoleArn, properties.ValidationExternalId)
-  });
+  const route53 = (roleArn, externalId) => {
+    return new import_client_route_53.Route53Client({
+      retryMode: "adaptive",
+      credentials: assumeRole(roleArn, externalId)
+    });
+  };
   switch (event.RequestType) {
     case "Create": {
       console.log(`Requesting new certificate:
@@ -273,13 +358,7 @@ ${objectToString(properties)}`);
       if (properties.RemovalPolicy === "destroy") {
         console.log(`Deleting old certificate as per removal policy:
 ${objectToString(properties)}`);
-        await deleteCertificate(
-          acm,
-          route53,
-          certificateArn,
-          properties.HostedZoneId,
-          stringToBoolean(properties.CleanupValidationRecords)
-        );
+        await deleteCertificate(acm, route53, certificateArn, properties);
       }
       return {
         PhysicalResourceId: certificateArn,

package/assets/certificate-requestor.lambda/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/certificate-requestor.lambda.ts", "../../src/utils.ts"],
-  "sourcesContent": ["import * as crypto from 'crypto'\nimport {\n  ACMClient,\n  AddTagsToCertificateCommand,\n  AddTagsToCertificateCommandInput,\n  CertificateDetail,\n  DeleteCertificateCommand,\n  DeleteCertificateCommandInput,\n  DescribeCertificateCommand,\n  DescribeCertificateCommandInput,\n  RequestCertificateCommand,\n  RequestCertificateCommandInput,\n  waitUntilCertificateValidated,\n} from '@aws-sdk/client-acm'\nimport {\n  ChangeAction,\n  ChangeResourceRecordSetsCommand,\n  ChangeResourceRecordSetsCommandInput,\n  InvalidChangeBatch,\n  ResourceRecordSet,\n  Route53Client,\n  waitUntilResourceRecordSetsChanged,\n} from '@aws-sdk/client-route-53'\nimport { AssumeRoleCommand, AssumeRoleCommandInput, STSClient } from '@aws-sdk/client-sts'\nimport type { AwsCredentialIdentity, Provider } from '@aws-sdk/types'\nimport type { CloudFormationCustomResourceEvent } from 'aws-lambda'\nimport { containsSame, objectToString, stringToBoolean, tryFor } from './utils'\n\nexport type Properties = {\n  HostedZoneId: string\n  DomainName: string\n  SubjectAlternativeNames?: string[]\n  CertificateRegion: string\n  ValidationRoleArn?: string\n  ValidationExternalId?: string\n  CleanupValidationRecords: string\n  TransparencyLoggingEnabled: string\n  Tags?: Record<string, string>\n  RemovalPolicy: string\n}\n\nconst parseProperties = (properties: Record<string, any>): Properties => {\n  // maybe should actually parse and not just assume\n  return properties as unknown as Properties\n}\n\nconst parseDomainValidationRecords = (certificate: CertificateDetail): ResourceRecordSet[] | null => {\n  const options = certificate.DomainValidationOptions ?? []\n  if (options.length > 0 && options.every((opt) => opt.ResourceRecord?.Name)) {\n    const uniqueRecords = [...new Map(options.map((opt) => [opt.ResourceRecord?.Name!, opt.ResourceRecord!])).values()]\n    return uniqueRecords.map((record) => {\n      return {\n        Name: record.Name,\n        Type: record.Type,\n        TTL: 30,\n        ResourceRecords: [\n          {\n            Value: record.Value,\n          },\n        ],\n      }\n    })\n  }\n  return null\n}\n\nconst changeRecordSets = async (\n  route53: Route53Client,\n  action: ChangeAction,\n  records: ResourceRecordSet[],\n  hostedZoneId: string\n): Promise<string> => {\n  const changeRecordSetsInput: ChangeResourceRecordSetsCommandInput = {\n    HostedZoneId: hostedZoneId,\n    ChangeBatch: {\n      Changes: records.map((record) => ({\n        Action: action,\n        ResourceRecordSet: record,\n      })),\n    },\n  }\n  const { ChangeInfo } = await route53.send(new ChangeResourceRecordSetsCommand(changeRecordSetsInput))\n  const result = await waitUntilResourceRecordSetsChanged({ client: route53, maxWaitTime: 180 }, { Id: ChangeInfo?.Id })\n  if (result.state !== 'SUCCESS') {\n    throw new Error(\n      `Record sets never changed for hosted zone ${hostedZoneId}: [${result.state}] ${result.reason ?? ''}`\n    )\n  }\n  return ChangeInfo?.Id!\n}\n\nconst requestCertificate = async (\n  acm: ACMClient,\n  route53: Route53Client,\n  requestId: string,\n  properties: Properties\n): Promise<string> => {\n  const { HostedZoneId, DomainName, SubjectAlternativeNames, TransparencyLoggingEnabled } = properties\n\n  console.log(`Requesting certificate for ${DomainName}`)\n\n  const requestCertificateInput: RequestCertificateCommandInput = {\n    DomainName,\n    SubjectAlternativeNames: SubjectAlternativeNames,\n    IdempotencyToken: crypto.createHash('sha256').update(requestId).digest('hex').slice(0, 32),\n    ValidationMethod: 'DNS',\n    Options: {\n      CertificateTransparencyLoggingPreference: TransparencyLoggingEnabled ? 'ENABLED' : 'DISABLED',\n    },\n  }\n  const { CertificateArn } = await acm.send(new RequestCertificateCommand(requestCertificateInput))\n\n  console.log(`Certificate ${CertificateArn} requested`)\n\n  const validationMaxSeconds = 180\n  const validationTimeoutError = `Domain validation options were not found in ${validationMaxSeconds} seconds`\n  const validationRecords = await tryFor(validationMaxSeconds, validationTimeoutError, async () => {\n    const describeCertificateInput: DescribeCertificateCommandInput = {\n      CertificateArn,\n    }\n    const { Certificate } = await acm.send(new DescribeCertificateCommand(describeCertificateInput))\n    return parseDomainValidationRecords(Certificate!)\n  })\n\n  console.log(`Upserting ${validationRecords.length} validation record(s) into hosted zone ${HostedZoneId}:`)\n  validationRecords.forEach((record) =>\n    console.log(`${record.Name} ${record.Type} ${record.ResourceRecords?.map((rr) => rr.Value).join(',')}`)\n  )\n  const changeId = await changeRecordSets(route53, 'UPSERT', validationRecords, HostedZoneId)\n  console.log(`All validation records changed succesfully for change id ${changeId.replace('/change/', '')}`)\n\n  console.log(`Waiting for certificate ${CertificateArn} to validate`)\n  const result = await waitUntilCertificateValidated({ client: acm, maxWaitTime: 300 }, { CertificateArn })\n  if (result.state !== 'SUCCESS') {\n    throw new Error(`Certificate failed ${CertificateArn} to validate: [${result.state}] ${result.reason ?? ''}`)\n  }\n  console.log(`Certificate ${CertificateArn} successfully validated`)\n  return CertificateArn!\n}\n\nconst deleteCertificate = async (\n  acm: ACMClient,\n  route53: Route53Client,\n  certificateArn: string,\n  hostedZoneId: string,\n  cleanupValidationRecords: boolean\n): Promise<void> => {\n  console.log(`Waiting for certificate ${certificateArn} usage to drain before deletion`)\n\n  const waitUsageMaxSeconds = 600\n  const waitUsageTimeoutError = `Certificate was still in use after ${waitUsageMaxSeconds} seconds`\n  const certificate = await tryFor(waitUsageMaxSeconds, waitUsageTimeoutError, async () => {\n    const describeCertificateInput: DescribeCertificateCommandInput = {\n      CertificateArn: certificateArn,\n    }\n    const { Certificate } = await acm.send(new DescribeCertificateCommand(describeCertificateInput))\n    const inUseBy = Certificate?.InUseBy ?? []\n    if (inUseBy.length > 0) {\n      return null\n    }\n    return Certificate!\n  })\n  console.log('Certificate is unused and will be deleted')\n\n  const validationRecords = parseDomainValidationRecords(certificate)\n  if (validationRecords && cleanupValidationRecords) {\n    console.log(`Deleting ${validationRecords.length} validation record(s) from hosted zone ${hostedZoneId}`)\n    try {\n      const changeId = await changeRecordSets(route53, 'DELETE', validationRecords, hostedZoneId)\n      console.log(`All validation records removed successfully for change id ${changeId.replace('/change/', '')}`)\n    } catch (error) {\n      if (error instanceof InvalidChangeBatch && error.message.includes('not found')) {\n        // there's a deletion race condition where some other certificate has already deleted the records\n        console.log(`All validation records have already been removed by some other certificate`)\n      } else {\n        throw error\n      }\n    }\n  }\n\n  console.log(`Deleting certificate ${certificateArn} from ACM`)\n  const deleteCertificateInput: DeleteCertificateCommandInput = {\n    CertificateArn: certificateArn,\n  }\n  await acm.send(new DeleteCertificateCommand(deleteCertificateInput))\n  console.log(`Certificate ${certificateArn} successfully deleted`)\n}\n\nconst addTags = async (acm: ACMClient, certificateArn: string, tags: Record<string, string>) => {\n  const tagList = Array.from(Object.entries(tags).map(([Key, Value]) => ({ Key, Value })))\n  const addTagsInput: AddTagsToCertificateCommandInput = {\n    CertificateArn: certificateArn,\n    Tags: tagList,\n  }\n\n  console.log(`Adding ${tagList.length} tags to certificate ${certificateArn}`)\n  await acm.send(new AddTagsToCertificateCommand(addTagsInput))\n  console.log(`All tags successfully added to certificate ${certificateArn}`)\n}\n\nconst shouldRequestNew = (oldProperties: Properties, newProperties: Properties): boolean => {\n  if (oldProperties.HostedZoneId !== newProperties.HostedZoneId) return true\n  if (oldProperties.DomainName !== newProperties.DomainName) return true\n  if (oldProperties.CertificateRegion !== newProperties.CertificateRegion) return true\n  if (!containsSame(oldProperties.SubjectAlternativeNames ?? [], newProperties.SubjectAlternativeNames ?? []))\n    return true\n  if (oldProperties.CleanupValidationRecords !== newProperties.CleanupValidationRecords) return true\n  if (oldProperties.TransparencyLoggingEnabled !== newProperties.TransparencyLoggingEnabled) return true\n  if (oldProperties.RemovalPolicy !== newProperties.RemovalPolicy) return true\n  return false\n}\n\nconst assumeRole = (\n  roleArn: string | undefined,\n  externalId: string | undefined\n): Provider<AwsCredentialIdentity> | undefined => {\n  if (!roleArn) {\n    return undefined\n  }\n  return async () => {\n    const sts = new STSClient({ retryMode: 'adaptive' })\n    const assumeRoleInput: AssumeRoleCommandInput = {\n      RoleArn: roleArn,\n      RoleSessionName: 'CertificateRequestor',\n      ExternalId: externalId,\n    }\n    const { Credentials } = await sts.send(new AssumeRoleCommand(assumeRoleInput))\n    return {\n      accessKeyId: Credentials?.AccessKeyId!,\n      secretAccessKey: Credentials?.SecretAccessKey!,\n      sessionToken: Credentials?.SessionToken!,\n      expiration: Credentials?.Expiration,\n    }\n  }\n}\n\nexport const handler = async (event: CloudFormationCustomResourceEvent) => {\n  const properties = parseProperties(event.ResourceProperties)\n\n  const acm = new ACMClient({ region: properties.CertificateRegion, retryMode: 'adaptive' })\n  const route53 = new Route53Client({\n    retryMode: 'adaptive',\n    credentials: assumeRole(properties.ValidationRoleArn, properties.ValidationExternalId),\n  })\n\n  switch (event.RequestType) {\n    case 'Create': {\n      console.log(`Requesting new certificate:\\n${objectToString(properties)}`)\n      const certificateArn = await requestCertificate(acm, route53, event.RequestId, properties)\n      if (properties.Tags && Object.entries(properties.Tags).length > 0) {\n        await addTags(acm, certificateArn, properties.Tags)\n      }\n      return {\n        PhysicalResourceId: certificateArn,\n        Data: {\n          Arn: certificateArn,\n        },\n      }\n    }\n    case 'Update': {\n      let certificateArn = event.PhysicalResourceId\n      if (shouldRequestNew(parseProperties(event.OldResourceProperties), properties)) {\n        console.log(`Requesting new certificate due to change of properties:\\n${objectToString(properties)}`)\n        certificateArn = await requestCertificate(acm, route53, event.RequestId, properties)\n      }\n      if (properties.Tags && Object.entries(properties.Tags).length > 0) {\n        await addTags(acm, certificateArn, properties.Tags)\n      }\n      return {\n        PhysicalResourceId: certificateArn,\n        Data: {\n          Arn: certificateArn,\n        },\n      }\n    }\n    case 'Delete': {\n      const certificateArn = event.PhysicalResourceId\n      if (properties.RemovalPolicy === 'destroy') {\n        console.log(`Deleting old certificate as per removal policy:\\n${objectToString(properties)}`)\n        await deleteCertificate(\n          acm,\n          route53,\n          certificateArn,\n          properties.HostedZoneId,\n          stringToBoolean(properties.CleanupValidationRecords)\n        )\n      }\n      return {\n        PhysicalResourceId: certificateArn,\n        Data: {\n          Arn: certificateArn,\n        },\n      }\n    }\n  }\n  throw new Error(`Invalid request type`)\n}\n", "export const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))\n\nexport const booleanToString = (value: boolean): string => {\n  return value ? 'true' : 'false'\n}\n\nexport const stringToBoolean = (value: string): boolean => {\n  return value === 'true' ? true : false\n}\n\nexport const objectToString = (value: object): string => {\n  return JSON.stringify(value, undefined, 2)\n}\n\nexport const containsSame = <T>(array1: T[], array2: T[]): boolean => {\n  if (array1.length !== array2.length) return false\n  return array1.every((v1) => array2.includes(v1))\n}\n\nexport const tryFor = async <T>(maxSeconds: number, timeoutError: string, fn: () => Promise<T | null>): Promise<T> => {\n  const startTime = Date.now()\n  // eslint-disable-next-line no-constant-condition\n  for (let i = 0; true; i++) {\n    if (Date.now() > startTime + maxSeconds * 1000) {\n      throw new Error(timeoutError)\n    }\n    const result = await fn()\n    if (result !== null) {\n      return result\n    }\n    const base = Math.pow(2, i)\n    await sleep(Math.random() * base * 50 + base * 150)\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAAwB;AACxB,wBAYO;AACP,6BAQO;AACP,wBAAqE;;;ACvB9D,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAM9E,IAAM,kBAAkB,CAAC,UAA2B;AACzD,SAAO,UAAU,SAAS,OAAO;AACnC;AAEO,IAAM,iBAAiB,CAAC,UAA0B;AACvD,SAAO,KAAK,UAAU,OAAO,QAAW,CAAC;AAC3C;AAEO,IAAM,eAAe,CAAI,QAAa,WAAyB;AACpE,MAAI,OAAO,WAAW,OAAO;AAAQ,WAAO;AAC5C,SAAO,OAAO,MAAM,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC;AACjD;AAEO,IAAM,SAAS,OAAU,YAAoB,cAAsB,OAA4C;AACpH,QAAM,YAAY,KAAK,IAAI;AAE3B,WAAS,IAAI,GAAG,MAAM,KAAK;AACzB,QAAI,KAAK,IAAI,IAAI,YAAY,aAAa,KAAM;AAC9C,YAAM,IAAI,MAAM,YAAY;AAAA,IAC9B;AACA,UAAM,SAAS,MAAM,GAAG;AACxB,QAAI,WAAW,MAAM;AACnB,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK,IAAI,GAAG,CAAC;AAC1B,UAAM,MAAM,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,GAAG;AAAA,EACpD;AACF;;;ADQA,IAAM,kBAAkB,CAAC,eAAgD;AAEvE,SAAO;AACT;AAEA,IAAM,+BAA+B,CAAC,gBAA+D;AACnG,QAAM,UAAU,YAAY,2BAA2B,CAAC;AACxD,MAAI,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,QAAQ,IAAI,gBAAgB,IAAI,GAAG;AAC1E,UAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,MAAO,IAAI,cAAe,CAAC,CAAC,EAAE,OAAO,CAAC;AAClH,WAAO,cAAc,IAAI,CAAC,WAAW;AACnC,aAAO;AAAA,QACL,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,KAAK;AAAA,QACL,iBAAiB;AAAA,UACf;AAAA,YACE,OAAO,OAAO;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB,OACvB,SACA,QACA,SACA,iBACoB;AACpB,QAAM,wBAA8D;AAAA,IAClE,cAAc;AAAA,IACd,aAAa;AAAA,MACX,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,QAChC,QAAQ;AAAA,QACR,mBAAmB;AAAA,MACrB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,QAAM,EAAE,WAAW,IAAI,MAAM,QAAQ,KAAK,IAAI,uDAAgC,qBAAqB,CAAC;AACpG,QAAM,SAAS,UAAM,2DAAmC,EAAE,QAAQ,SAAS,aAAa,IAAI,GAAG,EAAE,IAAI,YAAY,GAAG,CAAC;AACrH,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,IAAI;AAAA,MACR,6CAA6C,YAAY,MAAM,OAAO,KAAK,KAAK,OAAO,UAAU,EAAE;AAAA,IACrG;AAAA,EACF;AACA,SAAO,YAAY;AACrB;AAEA,IAAM,qBAAqB,OACzB,KACA,SACA,WACA,eACoB;AACpB,QAAM,EAAE,cAAc,YAAY,yBAAyB,2BAA2B,IAAI;AAE1F,UAAQ,IAAI,8BAA8B,UAAU,EAAE;AAEtD,QAAM,0BAA0D;AAAA,IAC9D;AAAA,IACA;AAAA,IACA,kBAAyB,kBAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,IACzF,kBAAkB;AAAA,IAClB,SAAS;AAAA,MACP,0CAA0C,6BAA6B,YAAY;AAAA,IACrF;AAAA,EACF;AACA,QAAM,EAAE,eAAe,IAAI,MAAM,IAAI,KAAK,IAAI,4CAA0B,uBAAuB,CAAC;AAEhG,UAAQ,IAAI,eAAe,cAAc,YAAY;AAErD,QAAM,uBAAuB;AAC7B,QAAM,yBAAyB,+CAA+C,oBAAoB;AAClG,QAAM,oBAAoB,MAAM,OAAO,sBAAsB,wBAAwB,YAAY;AAC/F,UAAM,2BAA4D;AAAA,MAChE;AAAA,IACF;AACA,UAAM,EAAE,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,6CAA2B,wBAAwB,CAAC;AAC/F,WAAO,6BAA6B,WAAY;AAAA,EAClD,CAAC;AAED,UAAQ,IAAI,aAAa,kBAAkB,MAAM,0CAA0C,YAAY,GAAG;AAC1G,oBAAkB;AAAA,IAAQ,CAAC,WACzB,QAAQ,IAAI,GAAG,OAAO,IAAI,IAAI,OAAO,IAAI,IAAI,OAAO,iBAAiB,IAAI,CAAC,OAAO,GAAG,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACxG;AACA,QAAM,WAAW,MAAM,iBAAiB,SAAS,UAAU,mBAAmB,YAAY;AAC1F,UAAQ,IAAI,4DAA4D,SAAS,QAAQ,YAAY,EAAE,CAAC,EAAE;AAE1G,UAAQ,IAAI,2BAA2B,cAAc,cAAc;AACnE,QAAM,SAAS,UAAM,iDAA8B,EAAE,QAAQ,KAAK,aAAa,IAAI,GAAG,EAAE,eAAe,CAAC;AACxG,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,IAAI,MAAM,sBAAsB,cAAc,kBAAkB,OAAO,KAAK,KAAK,OAAO,UAAU,EAAE,EAAE;AAAA,EAC9G;AACA,UAAQ,IAAI,eAAe,cAAc,yBAAyB;AAClE,SAAO;AACT;AAEA,IAAM,oBAAoB,OACxB,KACA,SACA,gBACA,cACA,6BACkB;AAClB,UAAQ,IAAI,2BAA2B,cAAc,iCAAiC;AAEtF,QAAM,sBAAsB;AAC5B,QAAM,wBAAwB,sCAAsC,mBAAmB;AACvF,QAAM,cAAc,MAAM,OAAO,qBAAqB,uBAAuB,YAAY;AACvF,UAAM,2BAA4D;AAAA,MAChE,gBAAgB;AAAA,IAClB;AACA,UAAM,EAAE,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,6CAA2B,wBAAwB,CAAC;AAC/F,UAAM,UAAU,aAAa,WAAW,CAAC;AACzC,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AACD,UAAQ,IAAI,2CAA2C;AAEvD,QAAM,oBAAoB,6BAA6B,WAAW;AAClE,MAAI,qBAAqB,0BAA0B;AACjD,YAAQ,IAAI,YAAY,kBAAkB,MAAM,0CAA0C,YAAY,EAAE;AACxG,QAAI;AACF,YAAM,WAAW,MAAM,iBAAiB,SAAS,UAAU,mBAAmB,YAAY;AAC1F,cAAQ,IAAI,6DAA6D,SAAS,QAAQ,YAAY,EAAE,CAAC,EAAE;AAAA,IAC7G,SAAS,OAAO;AACd,UAAI,iBAAiB,6CAAsB,MAAM,QAAQ,SAAS,WAAW,GAAG;AAE9E,gBAAQ,IAAI,4EAA4E;AAAA,MAC1F,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI,wBAAwB,cAAc,WAAW;AAC7D,QAAM,yBAAwD;AAAA,IAC5D,gBAAgB;AAAA,EAClB;AACA,QAAM,IAAI,KAAK,IAAI,2CAAyB,sBAAsB,CAAC;AACnE,UAAQ,IAAI,eAAe,cAAc,uBAAuB;AAClE;AAEA,IAAM,UAAU,OAAO,KAAgB,gBAAwB,SAAiC;AAC9F,QAAM,UAAU,MAAM,KAAK,OAAO,QAAQ,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;AACvF,QAAM,eAAiD;AAAA,IACrD,gBAAgB;AAAA,IAChB,MAAM;AAAA,EACR;AAEA,UAAQ,IAAI,UAAU,QAAQ,MAAM,wBAAwB,cAAc,EAAE;AAC5E,QAAM,IAAI,KAAK,IAAI,8CAA4B,YAAY,CAAC;AAC5D,UAAQ,IAAI,8CAA8C,cAAc,EAAE;AAC5E;AAEA,IAAM,mBAAmB,CAAC,eAA2B,kBAAuC;AAC1F,MAAI,cAAc,iBAAiB,cAAc;AAAc,WAAO;AACtE,MAAI,cAAc,eAAe,cAAc;AAAY,WAAO;AAClE,MAAI,cAAc,sBAAsB,cAAc;AAAmB,WAAO;AAChF,MAAI,CAAC,aAAa,cAAc,2BAA2B,CAAC,GAAG,cAAc,2BAA2B,CAAC,CAAC;AACxG,WAAO;AACT,MAAI,cAAc,6BAA6B,cAAc;AAA0B,WAAO;AAC9F,MAAI,cAAc,+BAA+B,cAAc;AAA4B,WAAO;AAClG,MAAI,cAAc,kBAAkB,cAAc;AAAe,WAAO;AACxE,SAAO;AACT;AAEA,IAAM,aAAa,CACjB,SACA,eACgD;AAChD,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY;AACjB,UAAM,MAAM,IAAI,4BAAU,EAAE,WAAW,WAAW,CAAC;AACnD,UAAM,kBAA0C;AAAA,MAC9C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,YAAY;AAAA,IACd;AACA,UAAM,EAAE,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,oCAAkB,eAAe,CAAC;AAC7E,WAAO;AAAA,MACL,aAAa,aAAa;AAAA,MAC1B,iBAAiB,aAAa;AAAA,MAC9B,cAAc,aAAa;AAAA,MAC3B,YAAY,aAAa;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,UAAU,OAAO,UAA6C;AACzE,QAAM,aAAa,gBAAgB,MAAM,kBAAkB;AAE3D,QAAM,MAAM,IAAI,4BAAU,EAAE,QAAQ,WAAW,mBAAmB,WAAW,WAAW,CAAC;AACzF,QAAM,UAAU,IAAI,qCAAc;AAAA,IAChC,WAAW;AAAA,IACX,aAAa,WAAW,WAAW,mBAAmB,WAAW,oBAAoB;AAAA,EACvF,CAAC;AAED,UAAQ,MAAM,aAAa;AAAA,IACzB,KAAK,UAAU;AACb,cAAQ,IAAI;AAAA,EAAgC,eAAe,UAAU,CAAC,EAAE;AACxE,YAAM,iBAAiB,MAAM,mBAAmB,KAAK,SAAS,MAAM,WAAW,UAAU;AACzF,UAAI,WAAW,QAAQ,OAAO,QAAQ,WAAW,IAAI,EAAE,SAAS,GAAG;AACjE,cAAM,QAAQ,KAAK,gBAAgB,WAAW,IAAI;AAAA,MACpD;AACA,aAAO;AAAA,QACL,oBAAoB;AAAA,QACpB,MAAM;AAAA,UACJ,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,UAAI,iBAAiB,MAAM;AAC3B,UAAI,iBAAiB,gBAAgB,MAAM,qBAAqB,GAAG,UAAU,GAAG;AAC9E,gBAAQ,IAAI;AAAA,EAA4D,eAAe,UAAU,CAAC,EAAE;AACpG,yBAAiB,MAAM,mBAAmB,KAAK,SAAS,MAAM,WAAW,UAAU;AAAA,MACrF;AACA,UAAI,WAAW,QAAQ,OAAO,QAAQ,WAAW,IAAI,EAAE,SAAS,GAAG;AACjE,cAAM,QAAQ,KAAK,gBAAgB,WAAW,IAAI;AAAA,MACpD;AACA,aAAO;AAAA,QACL,oBAAoB;AAAA,QACpB,MAAM;AAAA,UACJ,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,YAAM,iBAAiB,MAAM;AAC7B,UAAI,WAAW,kBAAkB,WAAW;AAC1C,gBAAQ,IAAI;AAAA,EAAoD,eAAe,UAAU,CAAC,EAAE;AAC5F,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW;AAAA,UACX,gBAAgB,WAAW,wBAAwB;AAAA,QACrD;AAAA,MACF;AACA,aAAO;AAAA,QACL,oBAAoB;AAAA,QACpB,MAAM;AAAA,UACJ,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,sBAAsB;AACxC;",
+  "sourcesContent": ["import * as crypto from 'crypto'\nimport {\n  ACMClient,\n  AddTagsToCertificateCommand,\n  AddTagsToCertificateCommandInput,\n  CertificateDetail,\n  DeleteCertificateCommand,\n  DeleteCertificateCommandInput,\n  DescribeCertificateCommand,\n  DescribeCertificateCommandInput,\n  RequestCertificateCommand,\n  RequestCertificateCommandInput,\n  waitUntilCertificateValidated,\n} from '@aws-sdk/client-acm'\nimport {\n  ChangeAction,\n  ChangeResourceRecordSetsCommand,\n  ChangeResourceRecordSetsCommandInput,\n  InvalidChangeBatch,\n  ResourceRecordSet,\n  Route53Client,\n  waitUntilResourceRecordSetsChanged,\n} from '@aws-sdk/client-route-53'\nimport { AssumeRoleCommand, AssumeRoleCommandInput, STSClient } from '@aws-sdk/client-sts'\nimport type { AwsCredentialIdentity, Provider } from '@aws-sdk/types'\nimport type { CloudFormationCustomResourceEvent } from 'aws-lambda'\nimport {\n  cleanChangeId,\n  cleanDomainName,\n  containsSame,\n  objectToString,\n  orderBySignificance,\n  stringToBoolean,\n  tryFor,\n} from './utils'\n\nexport type ValidationHostedZoneProperties = {\n  DomainName: string\n  HostedZoneId: string\n  ValidationRoleArn?: string\n  ValidationExternalId?: string\n}\n\nexport type Properties = {\n  DomainName: string\n  AlternativeDomainNames?: string[]\n  ValidationHostedZones: Record<string, ValidationHostedZoneProperties>\n  CertificateRegion: string\n  CleanupValidationRecords: string\n  TransparencyLoggingEnabled: string\n  Tags?: Record<string, string>\n  RemovalPolicy: string\n}\n\ntype Route53Factory = (roleArn: string | undefined, externalId: string | undefined) => Route53Client\n\nconst parseProperties = (properties: Record<string, any>): Properties => {\n  // maybe should actually parse and not just assume\n  return properties as unknown as Properties\n}\n\nconst parseDomainValidationRecords = (certificate: CertificateDetail): ResourceRecordSet[] | null => {\n  const options = certificate.DomainValidationOptions ?? []\n  if (options.length > 0 && options.every((opt) => opt.ResourceRecord?.Name)) {\n    const uniqueRecords = [...new Map(options.map((opt) => [opt.ResourceRecord?.Name!, opt.ResourceRecord!])).values()]\n    return uniqueRecords.map((record) => {\n      return {\n        Name: record.Name,\n        Type: record.Type,\n        TTL: 30,\n        ResourceRecords: [\n          {\n            Value: record.Value,\n          },\n        ],\n      }\n    })\n  }\n  return null\n}\n\nconst changeRecordSets = async (\n  route53: Route53Client,\n  action: ChangeAction,\n  records: ResourceRecordSet[],\n  hostedZoneId: string\n): Promise<void> => {\n  const changeRecordSetsInput: ChangeResourceRecordSetsCommandInput = {\n    HostedZoneId: hostedZoneId,\n    ChangeBatch: {\n      Changes: records.map((record) => ({\n        Action: action,\n        ResourceRecordSet: record,\n      })),\n    },\n  }\n  try {\n    const { ChangeInfo } = await route53.send(new ChangeResourceRecordSetsCommand(changeRecordSetsInput))\n    const changeId = ChangeInfo?.Id!\n    const result = await waitUntilResourceRecordSetsChanged({ client: route53, maxWaitTime: 180 }, { Id: changeId })\n    if (result.state !== 'SUCCESS') {\n      throw new Error(\n        `Validation records never changed for hosted zone ${hostedZoneId}: [${result.state}] ${result.reason ?? ''}`\n      )\n    }\n    const operation = action === 'CREATE' || action === 'UPSERT' ? 'changed' : 'deleted'\n    const change = cleanChangeId(changeId)\n    console.log(`Validation records succesfully ${operation} for hosted zone ${hostedZoneId} with change id ${change}`)\n  } catch (error: unknown) {\n    if (action === 'DELETE' && error instanceof InvalidChangeBatch && error.message.includes('not found')) {\n      // there's a deletion race condition where some other certificate has already deleted the records\n      console.log(`All validation records have already been removed by some other certificate`)\n    } else {\n      throw error\n    }\n  }\n}\n\nconst getRecordsForZoneNames = (\n  records: ResourceRecordSet[],\n  zoneNames: string[],\n  result?: Record<string, ResourceRecordSet[]>\n): Record<string, ResourceRecordSet[]> => {\n  const [zoneName, ...restZoneNames] = zoneNames\n  if (!zoneName) {\n    return result ?? {}\n  }\n  const matchingRecords: ResourceRecordSet[] = []\n  const unmatchingRecords: ResourceRecordSet[] = []\n  for (const record of records) {\n    const normalizedRecordName = cleanDomainName(record.Name!)\n    if (normalizedRecordName.endsWith(zoneName)) {\n      matchingRecords.push(record)\n    } else {\n      unmatchingRecords.push(record)\n    }\n  }\n  return getRecordsForZoneNames(unmatchingRecords, restZoneNames, {\n    ...(result ?? {}),\n    [zoneName]: matchingRecords,\n  })\n}\n\nconst requestCertificate = async (\n  acm: ACMClient,\n  route53: Route53Factory,\n  requestId: string,\n  properties: Properties\n): Promise<string> => {\n  const { DomainName, AlternativeDomainNames, TransparencyLoggingEnabled } = properties\n\n  console.log(`Requesting certificate for ${DomainName}`)\n\n  const requestCertificateInput: RequestCertificateCommandInput = {\n    DomainName,\n    SubjectAlternativeNames: AlternativeDomainNames,\n    IdempotencyToken: crypto.createHash('sha256').update(requestId).digest('hex').slice(0, 32),\n    ValidationMethod: 'DNS',\n    Options: {\n      CertificateTransparencyLoggingPreference: TransparencyLoggingEnabled ? 'ENABLED' : 'DISABLED',\n    },\n  }\n  const { CertificateArn } = await acm.send(new RequestCertificateCommand(requestCertificateInput))\n\n  console.log(`Certificate ${CertificateArn} requested`)\n\n  const validationMaxSeconds = 180\n  const validationTimeoutError = `Domain validation options were not found in ${validationMaxSeconds} seconds`\n  const validationRecords = await tryFor(validationMaxSeconds, validationTimeoutError, async () => {\n    const describeCertificateInput: DescribeCertificateCommandInput = {\n      CertificateArn,\n    }\n    const { Certificate } = await acm.send(new DescribeCertificateCommand(describeCertificateInput))\n    return parseDomainValidationRecords(Certificate!)\n  })\n\n  const hostedZones = Object.values(properties.ValidationHostedZones)\n  const hostedZoneIds = hostedZones.map((zone) => zone.HostedZoneId)\n\n  console.log(\n    `Upserting ${validationRecords.length} validation record(s) into hosted zone(s) ${hostedZoneIds.join(', ')}:`\n  )\n  validationRecords.forEach((record) =>\n    console.log(`${record.Name} ${record.Type} ${record.ResourceRecords?.map((rr) => rr.Value).join(',')}`)\n  )\n\n  const recordsForZoneNames = getRecordsForZoneNames(\n    validationRecords,\n    orderBySignificance(Object.keys(properties.ValidationHostedZones))\n  )\n  for (const hostedZone of hostedZones) {\n    const records = recordsForZoneNames[hostedZone.DomainName]\n    if (records.length > 0) {\n      await changeRecordSets(\n        route53(hostedZone.ValidationRoleArn, hostedZone.ValidationExternalId),\n        'UPSERT',\n        records,\n        hostedZone.HostedZoneId\n      )\n    }\n  }\n\n  console.log(`Waiting for certificate ${CertificateArn} to validate`)\n  const result = await waitUntilCertificateValidated({ client: acm, maxWaitTime: 300 }, { CertificateArn })\n  if (result.state !== 'SUCCESS') {\n    throw new Error(`Certificate failed ${CertificateArn} to validate: [${result.state}] ${result.reason ?? ''}`)\n  }\n  console.log(`Certificate ${CertificateArn} successfully validated`)\n  return CertificateArn!\n}\n\nconst deleteCertificate = async (\n  acm: ACMClient,\n  route53: Route53Factory,\n  certificateArn: string,\n  properties: Properties\n): Promise<void> => {\n  console.log(`Waiting for certificate ${certificateArn} usage to drain before deletion`)\n\n  const waitUsageMaxSeconds = 600\n  const waitUsageTimeoutError = `Certificate was still in use after ${waitUsageMaxSeconds} seconds`\n  const certificate = await tryFor(waitUsageMaxSeconds, waitUsageTimeoutError, async () => {\n    const describeCertificateInput: DescribeCertificateCommandInput = {\n      CertificateArn: certificateArn,\n    }\n    const { Certificate } = await acm.send(new DescribeCertificateCommand(describeCertificateInput))\n    const inUseBy = Certificate?.InUseBy ?? []\n    if (inUseBy.length > 0) {\n      return null\n    }\n    return Certificate!\n  })\n  console.log('Certificate is unused and will be deleted')\n\n  const validationRecords = parseDomainValidationRecords(certificate)\n  if (validationRecords && stringToBoolean(properties.CleanupValidationRecords)) {\n    const hostedZones = Object.values(properties.ValidationHostedZones)\n    const hostedZoneIds = hostedZones.map((zone) => zone.HostedZoneId)\n\n    console.log(\n      `Deleting ${validationRecords.length} validation record(s) from hosted zone(s) ${hostedZoneIds.join(', ')}`\n    )\n\n    const recordsForZoneNames = getRecordsForZoneNames(\n      validationRecords,\n      orderBySignificance(Object.keys(properties.ValidationHostedZones))\n    )\n    for (const hostedZone of hostedZones) {\n      const records = recordsForZoneNames[hostedZone.DomainName]\n      if (records.length > 0) {\n        await changeRecordSets(\n          route53(hostedZone.ValidationRoleArn, hostedZone.ValidationExternalId),\n          'DELETE',\n          records,\n          hostedZone.HostedZoneId\n        )\n      }\n    }\n  }\n\n  console.log(`Deleting certificate ${certificateArn} from ACM`)\n  const deleteCertificateInput: DeleteCertificateCommandInput = {\n    CertificateArn: certificateArn,\n  }\n  await acm.send(new DeleteCertificateCommand(deleteCertificateInput))\n  console.log(`Certificate ${certificateArn} successfully deleted`)\n}\n\nconst addTags = async (acm: ACMClient, certificateArn: string, tags: Record<string, string>) => {\n  const tagList = Array.from(Object.entries(tags).map(([Key, Value]) => ({ Key, Value })))\n  const addTagsInput: AddTagsToCertificateCommandInput = {\n    CertificateArn: certificateArn,\n    Tags: tagList,\n  }\n\n  console.log(`Adding ${tagList.length} tags to certificate ${certificateArn}`)\n  await acm.send(new AddTagsToCertificateCommand(addTagsInput))\n  console.log(`All tags successfully added to certificate ${certificateArn}`)\n}\n\nconst shouldRequestNew = (oldProperties: Properties, newProperties: Properties): boolean => {\n  const oldHostedZoneIds = Object.values(oldProperties.ValidationHostedZones ?? {}).map((zone) => zone.HostedZoneId)\n  const newHostedZoneIds = Object.values(newProperties.ValidationHostedZones ?? {}).map((zone) => zone.HostedZoneId)\n  if (!containsSame(oldHostedZoneIds, newHostedZoneIds)) return true\n  if (oldProperties.DomainName !== newProperties.DomainName) return true\n  if (!containsSame(oldProperties.AlternativeDomainNames ?? [], newProperties.AlternativeDomainNames ?? [])) return true\n  if (oldProperties.CertificateRegion !== newProperties.CertificateRegion) return true\n  if (oldProperties.CleanupValidationRecords !== newProperties.CleanupValidationRecords) return true\n  if (oldProperties.TransparencyLoggingEnabled !== newProperties.TransparencyLoggingEnabled) return true\n  if (oldProperties.RemovalPolicy !== newProperties.RemovalPolicy) return true\n  return false\n}\n\nconst assumeRole = (\n  roleArn: string | undefined,\n  externalId: string | undefined\n): Provider<AwsCredentialIdentity> | undefined => {\n  if (!roleArn) {\n    return undefined\n  }\n  return async () => {\n    const sts = new STSClient({ retryMode: 'adaptive' })\n    const assumeRoleInput: AssumeRoleCommandInput = {\n      RoleArn: roleArn,\n      RoleSessionName: 'CertificateRequestor',\n      ExternalId: externalId,\n    }\n    const { Credentials } = await sts.send(new AssumeRoleCommand(assumeRoleInput))\n    return {\n      accessKeyId: Credentials?.AccessKeyId!,\n      secretAccessKey: Credentials?.SecretAccessKey!,\n      sessionToken: Credentials?.SessionToken!,\n      expiration: Credentials?.Expiration,\n    }\n  }\n}\n\nexport const handler = async (event: CloudFormationCustomResourceEvent) => {\n  const properties = parseProperties(event.ResourceProperties)\n\n  const acm = new ACMClient({ region: properties.CertificateRegion, retryMode: 'adaptive' })\n  const route53 = (roleArn: string | undefined, externalId: string | undefined): Route53Client => {\n    return new Route53Client({\n      retryMode: 'adaptive',\n      credentials: assumeRole(roleArn, externalId),\n    })\n  }\n\n  switch (event.RequestType) {\n    case 'Create': {\n      console.log(`Requesting new certificate:\\n${objectToString(properties)}`)\n      const certificateArn = await requestCertificate(acm, route53, event.RequestId, properties)\n      if (properties.Tags && Object.entries(properties.Tags).length > 0) {\n        await addTags(acm, certificateArn, properties.Tags)\n      }\n      return {\n        PhysicalResourceId: certificateArn,\n        Data: {\n          Arn: certificateArn,\n        },\n      }\n    }\n    case 'Update': {\n      let certificateArn = event.PhysicalResourceId\n      if (shouldRequestNew(parseProperties(event.OldResourceProperties), properties)) {\n        console.log(`Requesting new certificate due to change of properties:\\n${objectToString(properties)}`)\n        certificateArn = await requestCertificate(acm, route53, event.RequestId, properties)\n      }\n      if (properties.Tags && Object.entries(properties.Tags).length > 0) {\n        await addTags(acm, certificateArn, properties.Tags)\n      }\n      return {\n        PhysicalResourceId: certificateArn,\n        Data: {\n          Arn: certificateArn,\n        },\n      }\n    }\n    case 'Delete': {\n      const certificateArn = event.PhysicalResourceId\n      if (properties.RemovalPolicy === 'destroy') {\n        console.log(`Deleting old certificate as per removal policy:\\n${objectToString(properties)}`)\n        await deleteCertificate(acm, route53, certificateArn, properties)\n      }\n      return {\n        PhysicalResourceId: certificateArn,\n        Data: {\n          Arn: certificateArn,\n        },\n      }\n    }\n  }\n  throw new Error(`Invalid request type`)\n}\n", "export const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))\n\nexport const booleanToString = (value: boolean): string => {\n  return value ? 'true' : 'false'\n}\n\nexport const stringToBoolean = (value: string): boolean => {\n  return value === 'true' ? true : false\n}\n\nexport const objectToString = (value: object): string => {\n  return JSON.stringify(value, undefined, 2)\n}\n\nexport const containsSame = <T>(array1: T[], array2: T[]): boolean => {\n  if (array1.length !== array2.length) return false\n  return array1.every((v1) => array2.includes(v1))\n}\n\nexport const orderBySignificance = (domains: string[]): string[] => {\n  const copy = [...domains]\n  copy.sort((a, b) => {\n    const ac = a.split('.').length\n    const bc = b.split('.').length\n    if (ac > bc) {\n      return -1\n    }\n    if (ac < bc) {\n      return 1\n    }\n    return 0\n  })\n  return copy\n}\n\nexport const cleanDomainName = (domainName: string): string => {\n  if (domainName.endsWith('.')) {\n    return domainName.slice(0, -1)\n  }\n  return domainName\n}\n\nexport const cleanHostedZoneId = (hostedZoneId: string): string => {\n  return hostedZoneId.replace(/^\\/hostedzone\\//, '')\n}\n\nexport const cleanChangeId = (changeId: string): string => {\n  return changeId.replace('/change/', '')\n}\n\nexport const tryFor = async <T>(maxSeconds: number, timeoutError: string, fn: () => Promise<T | null>): Promise<T> => {\n  const startTime = Date.now()\n  // eslint-disable-next-line no-constant-condition\n  for (let i = 0; true; i++) {\n    if (Date.now() > startTime + maxSeconds * 1000) {\n      throw new Error(timeoutError)\n    }\n    const result = await fn()\n    if (result !== null) {\n      return result\n    }\n    const base = Math.pow(2, i)\n    await sleep(Math.random() * base * 50 + base * 150)\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAAwB;AACxB,wBAYO;AACP,6BAQO;AACP,wBAAqE;;;ACvB9D,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAM9E,IAAM,kBAAkB,CAAC,UAA2B;AACzD,SAAO,UAAU,SAAS,OAAO;AACnC;AAEO,IAAM,iBAAiB,CAAC,UAA0B;AACvD,SAAO,KAAK,UAAU,OAAO,QAAW,CAAC;AAC3C;AAEO,IAAM,eAAe,CAAI,QAAa,WAAyB;AACpE,MAAI,OAAO,WAAW,OAAO;AAAQ,WAAO;AAC5C,SAAO,OAAO,MAAM,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC;AACjD;AAEO,IAAM,sBAAsB,CAAC,YAAgC;AAClE,QAAM,OAAO,CAAC,GAAG,OAAO;AACxB,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,UAAM,KAAK,EAAE,MAAM,GAAG,EAAE;AACxB,UAAM,KAAK,EAAE,MAAM,GAAG,EAAE;AACxB,QAAI,KAAK,IAAI;AACX,aAAO;AAAA,IACT;AACA,QAAI,KAAK,IAAI;AACX,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAEO,IAAM,kBAAkB,CAAC,eAA+B;AAC7D,MAAI,WAAW,SAAS,GAAG,GAAG;AAC5B,WAAO,WAAW,MAAM,GAAG,EAAE;AAAA,EAC/B;AACA,SAAO;AACT;AAMO,IAAM,gBAAgB,CAAC,aAA6B;AACzD,SAAO,SAAS,QAAQ,YAAY,EAAE;AACxC;AAEO,IAAM,SAAS,OAAU,YAAoB,cAAsB,OAA4C;AACpH,QAAM,YAAY,KAAK,IAAI;AAE3B,WAAS,IAAI,GAAG,MAAM,KAAK;AACzB,QAAI,KAAK,IAAI,IAAI,YAAY,aAAa,KAAM;AAC9C,YAAM,IAAI,MAAM,YAAY;AAAA,IAC9B;AACA,UAAM,SAAS,MAAM,GAAG;AACxB,QAAI,WAAW,MAAM;AACnB,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK,IAAI,GAAG,CAAC;AAC1B,UAAM,MAAM,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,GAAG;AAAA,EACpD;AACF;;;ADRA,IAAM,kBAAkB,CAAC,eAAgD;AAEvE,SAAO;AACT;AAEA,IAAM,+BAA+B,CAAC,gBAA+D;AACnG,QAAM,UAAU,YAAY,2BAA2B,CAAC;AACxD,MAAI,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,QAAQ,IAAI,gBAAgB,IAAI,GAAG;AAC1E,UAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,MAAO,IAAI,cAAe,CAAC,CAAC,EAAE,OAAO,CAAC;AAClH,WAAO,cAAc,IAAI,CAAC,WAAW;AACnC,aAAO;AAAA,QACL,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,KAAK;AAAA,QACL,iBAAiB;AAAA,UACf;AAAA,YACE,OAAO,OAAO;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB,OACvB,SACA,QACA,SACA,iBACkB;AAClB,QAAM,wBAA8D;AAAA,IAClE,cAAc;AAAA,IACd,aAAa;AAAA,MACX,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,QAChC,QAAQ;AAAA,QACR,mBAAmB;AAAA,MACrB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,MAAM,QAAQ,KAAK,IAAI,uDAAgC,qBAAqB,CAAC;AACpG,UAAM,WAAW,YAAY;AAC7B,UAAM,SAAS,UAAM,2DAAmC,EAAE,QAAQ,SAAS,aAAa,IAAI,GAAG,EAAE,IAAI,SAAS,CAAC;AAC/G,QAAI,OAAO,UAAU,WAAW;AAC9B,YAAM,IAAI;AAAA,QACR,oDAAoD,YAAY,MAAM,OAAO,KAAK,KAAK,OAAO,UAAU,EAAE;AAAA,MAC5G;AAAA,IACF;AACA,UAAM,YAAY,WAAW,YAAY,WAAW,WAAW,YAAY;AAC3E,UAAM,SAAS,cAAc,QAAQ;AACrC,YAAQ,IAAI,kCAAkC,SAAS,oBAAoB,YAAY,mBAAmB,MAAM,EAAE;AAAA,EACpH,SAAS,OAAgB;AACvB,QAAI,WAAW,YAAY,iBAAiB,6CAAsB,MAAM,QAAQ,SAAS,WAAW,GAAG;AAErG,cAAQ,IAAI,4EAA4E;AAAA,IAC1F,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,yBAAyB,CAC7B,SACA,WACA,WACwC;AACxC,QAAM,CAAC,UAAU,GAAG,aAAa,IAAI;AACrC,MAAI,CAAC,UAAU;AACb,WAAO,UAAU,CAAC;AAAA,EACpB;AACA,QAAM,kBAAuC,CAAC;AAC9C,QAAM,oBAAyC,CAAC;AAChD,aAAW,UAAU,SAAS;AAC5B,UAAM,uBAAuB,gBAAgB,OAAO,IAAK;AACzD,QAAI,qBAAqB,SAAS,QAAQ,GAAG;AAC3C,sBAAgB,KAAK,MAAM;AAAA,IAC7B,OAAO;AACL,wBAAkB,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,uBAAuB,mBAAmB,eAAe;AAAA,IAC9D,GAAI,UAAU,CAAC;AAAA,IACf,CAAC,QAAQ,GAAG;AAAA,EACd,CAAC;AACH;AAEA,IAAM,qBAAqB,OACzB,KACA,SACA,WACA,eACoB;AACpB,QAAM,EAAE,YAAY,wBAAwB,2BAA2B,IAAI;AAE3E,UAAQ,IAAI,8BAA8B,UAAU,EAAE;AAEtD,QAAM,0BAA0D;AAAA,IAC9D;AAAA,IACA,yBAAyB;AAAA,IACzB,kBAAyB,kBAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,IACzF,kBAAkB;AAAA,IAClB,SAAS;AAAA,MACP,0CAA0C,6BAA6B,YAAY;AAAA,IACrF;AAAA,EACF;AACA,QAAM,EAAE,eAAe,IAAI,MAAM,IAAI,KAAK,IAAI,4CAA0B,uBAAuB,CAAC;AAEhG,UAAQ,IAAI,eAAe,cAAc,YAAY;AAErD,QAAM,uBAAuB;AAC7B,QAAM,yBAAyB,+CAA+C,oBAAoB;AAClG,QAAM,oBAAoB,MAAM,OAAO,sBAAsB,wBAAwB,YAAY;AAC/F,UAAM,2BAA4D;AAAA,MAChE;AAAA,IACF;AACA,UAAM,EAAE,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,6CAA2B,wBAAwB,CAAC;AAC/F,WAAO,6BAA6B,WAAY;AAAA,EAClD,CAAC;AAED,QAAM,cAAc,OAAO,OAAO,WAAW,qBAAqB;AAClE,QAAM,gBAAgB,YAAY,IAAI,CAAC,SAAS,KAAK,YAAY;AAEjE,UAAQ;AAAA,IACN,aAAa,kBAAkB,MAAM,6CAA6C,cAAc,KAAK,IAAI,CAAC;AAAA,EAC5G;AACA,oBAAkB;AAAA,IAAQ,CAAC,WACzB,QAAQ,IAAI,GAAG,OAAO,IAAI,IAAI,OAAO,IAAI,IAAI,OAAO,iBAAiB,IAAI,CAAC,OAAO,GAAG,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACxG;AAEA,QAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA,oBAAoB,OAAO,KAAK,WAAW,qBAAqB,CAAC;AAAA,EACnE;AACA,aAAW,cAAc,aAAa;AACpC,UAAM,UAAU,oBAAoB,WAAW,UAAU;AACzD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM;AAAA,QACJ,QAAQ,WAAW,mBAAmB,WAAW,oBAAoB;AAAA,QACrE;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI,2BAA2B,cAAc,cAAc;AACnE,QAAM,SAAS,UAAM,iDAA8B,EAAE,QAAQ,KAAK,aAAa,IAAI,GAAG,EAAE,eAAe,CAAC;AACxG,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,IAAI,MAAM,sBAAsB,cAAc,kBAAkB,OAAO,KAAK,KAAK,OAAO,UAAU,EAAE,EAAE;AAAA,EAC9G;AACA,UAAQ,IAAI,eAAe,cAAc,yBAAyB;AAClE,SAAO;AACT;AAEA,IAAM,oBAAoB,OACxB,KACA,SACA,gBACA,eACkB;AAClB,UAAQ,IAAI,2BAA2B,cAAc,iCAAiC;AAEtF,QAAM,sBAAsB;AAC5B,QAAM,wBAAwB,sCAAsC,mBAAmB;AACvF,QAAM,cAAc,MAAM,OAAO,qBAAqB,uBAAuB,YAAY;AACvF,UAAM,2BAA4D;AAAA,MAChE,gBAAgB;AAAA,IAClB;AACA,UAAM,EAAE,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,6CAA2B,wBAAwB,CAAC;AAC/F,UAAM,UAAU,aAAa,WAAW,CAAC;AACzC,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AACD,UAAQ,IAAI,2CAA2C;AAEvD,QAAM,oBAAoB,6BAA6B,WAAW;AAClE,MAAI,qBAAqB,gBAAgB,WAAW,wBAAwB,GAAG;AAC7E,UAAM,cAAc,OAAO,OAAO,WAAW,qBAAqB;AAClE,UAAM,gBAAgB,YAAY,IAAI,CAAC,SAAS,KAAK,YAAY;AAEjE,YAAQ;AAAA,MACN,YAAY,kBAAkB,MAAM,6CAA6C,cAAc,KAAK,IAAI,CAAC;AAAA,IAC3G;AAEA,UAAM,sBAAsB;AAAA,MAC1B;AAAA,MACA,oBAAoB,OAAO,KAAK,WAAW,qBAAqB,CAAC;AAAA,IACnE;AACA,eAAW,cAAc,aAAa;AACpC,YAAM,UAAU,oBAAoB,WAAW,UAAU;AACzD,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM;AAAA,UACJ,QAAQ,WAAW,mBAAmB,WAAW,oBAAoB;AAAA,UACrE;AAAA,UACA;AAAA,UACA,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI,wBAAwB,cAAc,WAAW;AAC7D,QAAM,yBAAwD;AAAA,IAC5D,gBAAgB;AAAA,EAClB;AACA,QAAM,IAAI,KAAK,IAAI,2CAAyB,sBAAsB,CAAC;AACnE,UAAQ,IAAI,eAAe,cAAc,uBAAuB;AAClE;AAEA,IAAM,UAAU,OAAO,KAAgB,gBAAwB,SAAiC;AAC9F,QAAM,UAAU,MAAM,KAAK,OAAO,QAAQ,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;AACvF,QAAM,eAAiD;AAAA,IACrD,gBAAgB;AAAA,IAChB,MAAM;AAAA,EACR;AAEA,UAAQ,IAAI,UAAU,QAAQ,MAAM,wBAAwB,cAAc,EAAE;AAC5E,QAAM,IAAI,KAAK,IAAI,8CAA4B,YAAY,CAAC;AAC5D,UAAQ,IAAI,8CAA8C,cAAc,EAAE;AAC5E;AAEA,IAAM,mBAAmB,CAAC,eAA2B,kBAAuC;AAC1F,QAAM,mBAAmB,OAAO,OAAO,cAAc,yBAAyB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY;AACjH,QAAM,mBAAmB,OAAO,OAAO,cAAc,yBAAyB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY;AACjH,MAAI,CAAC,aAAa,kBAAkB,gBAAgB;AAAG,WAAO;AAC9D,MAAI,cAAc,eAAe,cAAc;AAAY,WAAO;AAClE,MAAI,CAAC,aAAa,cAAc,0BAA0B,CAAC,GAAG,cAAc,0BAA0B,CAAC,CAAC;AAAG,WAAO;AAClH,MAAI,cAAc,sBAAsB,cAAc;AAAmB,WAAO;AAChF,MAAI,cAAc,6BAA6B,cAAc;AAA0B,WAAO;AAC9F,MAAI,cAAc,+BAA+B,cAAc;AAA4B,WAAO;AAClG,MAAI,cAAc,kBAAkB,cAAc;AAAe,WAAO;AACxE,SAAO;AACT;AAEA,IAAM,aAAa,CACjB,SACA,eACgD;AAChD,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY;AACjB,UAAM,MAAM,IAAI,4BAAU,EAAE,WAAW,WAAW,CAAC;AACnD,UAAM,kBAA0C;AAAA,MAC9C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,YAAY;AAAA,IACd;AACA,UAAM,EAAE,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,oCAAkB,eAAe,CAAC;AAC7E,WAAO;AAAA,MACL,aAAa,aAAa;AAAA,MAC1B,iBAAiB,aAAa;AAAA,MAC9B,cAAc,aAAa;AAAA,MAC3B,YAAY,aAAa;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,UAAU,OAAO,UAA6C;AACzE,QAAM,aAAa,gBAAgB,MAAM,kBAAkB;AAE3D,QAAM,MAAM,IAAI,4BAAU,EAAE,QAAQ,WAAW,mBAAmB,WAAW,WAAW,CAAC;AACzF,QAAM,UAAU,CAAC,SAA6B,eAAkD;AAC9F,WAAO,IAAI,qCAAc;AAAA,MACvB,WAAW;AAAA,MACX,aAAa,WAAW,SAAS,UAAU;AAAA,IAC7C,CAAC;AAAA,EACH;AAEA,UAAQ,MAAM,aAAa;AAAA,IACzB,KAAK,UAAU;AACb,cAAQ,IAAI;AAAA,EAAgC,eAAe,UAAU,CAAC,EAAE;AACxE,YAAM,iBAAiB,MAAM,mBAAmB,KAAK,SAAS,MAAM,WAAW,UAAU;AACzF,UAAI,WAAW,QAAQ,OAAO,QAAQ,WAAW,IAAI,EAAE,SAAS,GAAG;AACjE,cAAM,QAAQ,KAAK,gBAAgB,WAAW,IAAI;AAAA,MACpD;AACA,aAAO;AAAA,QACL,oBAAoB;AAAA,QACpB,MAAM;AAAA,UACJ,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,UAAI,iBAAiB,MAAM;AAC3B,UAAI,iBAAiB,gBAAgB,MAAM,qBAAqB,GAAG,UAAU,GAAG;AAC9E,gBAAQ,IAAI;AAAA,EAA4D,eAAe,UAAU,CAAC,EAAE;AACpG,yBAAiB,MAAM,mBAAmB,KAAK,SAAS,MAAM,WAAW,UAAU;AAAA,MACrF;AACA,UAAI,WAAW,QAAQ,OAAO,QAAQ,WAAW,IAAI,EAAE,SAAS,GAAG;AACjE,cAAM,QAAQ,KAAK,gBAAgB,WAAW,IAAI;AAAA,MACpD;AACA,aAAO;AAAA,QACL,oBAAoB;AAAA,QACpB,MAAM;AAAA,UACJ,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,YAAM,iBAAiB,MAAM;AAC7B,UAAI,WAAW,kBAAkB,WAAW;AAC1C,gBAAQ,IAAI;AAAA,EAAoD,eAAe,UAAU,CAAC,EAAE;AAC5F,cAAM,kBAAkB,KAAK,SAAS,gBAAgB,UAAU;AAAA,MAClE;AACA,aAAO;AAAA,QACL,oBAAoB;AAAA,QACpB,MAAM;AAAA,UACJ,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,sBAAsB;AACxC;",
   "names": []
 }

package/lib/certificate-requestor.lambda.d.ts

@@ -1,11 +1,15 @@
 import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
-export type Properties = {
-    HostedZoneId: string;
+export type ValidationHostedZoneProperties = {
     DomainName: string;
-    SubjectAlternativeNames?: string[];
-    CertificateRegion: string;
+    HostedZoneId: string;
     ValidationRoleArn?: string;
     ValidationExternalId?: string;
+};
+export type Properties = {
+    DomainName: string;
+    AlternativeDomainNames?: string[];
+    ValidationHostedZones: Record<string, ValidationHostedZoneProperties>;
+    CertificateRegion: string;
     CleanupValidationRecords: string;
     TransparencyLoggingEnabled: string;
     Tags?: Record<string, string>;