@trautonen/cdk-dns-validated-certificate 0.0.53 → 0.1.1

package/.jsii

@@ -3485,7 +3485,7 @@
   },
   "name": "@trautonen/cdk-dns-validated-certificate",
   "readme": {
-    "markdown": "# AWS CDK DNS Validated Certificate\n\nCDK does not have a built in construct to manage cross-region or cross-account DNS validated certificates. There's an attempt to work around the issue with a cross region references option for stacks, but it has a lot of issues and still does not solve the cross-account use case.\n\nThis construct solves these problems by managing the certificate as a custom resource and with direct API calls to ACM and Route53. In the future it will be possible to support not only Route53, but other DNS services too.\n\nCurrently there's a limitation which does not allow using alternative names for the certificate as it would require mapping of different roles to different hosted zones. This API is currently being developed.\n\n## Usage for cross-region validation\n\n```typescript\n// hosted zone managed by the CDK application\nconst hostedZone: route53.IHostedZone = ...\n// no separate validation role is needed\nconst certificate = new DnsValidatedCertificate(this, 'CrossRegionCertificate', {\n  hostedZone: hostedZone,\n  domainName: 'example.com',     // must be compatible with the hosted zone\n  certificateRegion: 'us-east-1' // used by for example CloudFront\n})\n```\n\n## Usage for cross-account validation\n\n```typescript\n// external hosted zone\nconst hostedZone: route53.IHostedZone = route53.HostedZone.fromHostedZoneAttributes(this, 'HostedZone', {\n  hostedZoneId: 'Z532DGDEDFS123456789',\n  zoneName: 'example.com',\n})\n// validation role on the same account as the hosted zone\nconst roleArn = 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'\nconst externalId = 'domain-assume'\nconst validationRole: iam.IRole = iam.Role.fromRoleArn(this, 'ValidationRole', roleArn)\nconst certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {\n  hostedZone: hostedZone,\n  domainName: 'example.com',\n  validationRole: validationRole,\n  validationExternalId: externalId,\n})\n```\n"
+    "markdown": "# AWS CDK DNS Validated Certificate\n\nCDK does not have a built in construct to manage cross-region or cross-account DNS validated certificates. There's an\nattempt to work around the issue with a cross region references option for stacks, but it has a lot of issues and still\ndoes not solve the cross-account use case.\n\nThis construct solves these problems by managing the certificate as a custom resource and with direct API calls to ACM\nand Route53. In the future it will be possible to support not only Route53, but other DNS services too.\n\n## Usage for cross-region validation\n\n```typescript\n// hosted zone managed by the CDK application\nconst hostedZone: route53.IHostedZone = ...\n// no separate validation role is needed\nconst certificate = new DnsValidatedCertificate(this, 'CrossRegionCertificate', {\n  hostedZone: hostedZone,\n  domainName: 'example.com',     // must be compatible with the hosted zone\n  certificateRegion: 'us-east-1' // used by for example CloudFront\n})\n```\n\n## Usage for cross-account validation\n\n```typescript\n// external hosted zone\nconst hostedZone: route53.IHostedZone = route53.HostedZone.fromHostedZoneAttributes(this, 'HostedZone', {\n  hostedZoneId: 'Z532DGDEDFS123456789',\n  zoneName: 'example.com',\n})\n// validation role on the same account as the hosted zone\nconst roleArn = 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'\nconst externalId = 'domain-assume'\nconst validationRole: iam.IRole = iam.Role.fromRoleArn(this, 'ValidationRole', roleArn)\nconst certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {\n  hostedZone: hostedZone,\n  domainName: 'example.com',\n  validationRole: validationRole,\n  validationExternalId: externalId,\n})\n```\n\n## Usage for cross-account alternative names validation\n\n```typescript\n// example.com is validated on same account against managed hosted zone\n// and secondary.com is validated against external hosted zone on other account\nconst hostedZoneForMain: route53.IHostedZone = ...\nconst hostedZoneForAlternative: route53.IHostedZone =\n  route53.HostedZone.fromHostedZoneAttributes(this, 'SecondaryHostedZone', {\n  hostedZoneId: 'Z532DGDEDFS123456789',\n  zoneName: 'secondary.com'\n})\nconst certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {\n  domainName: 'example.com',\n  alternativeDomainNames: ['secondary.com'],\n  validationHostedZones: [{\n    hostedZone: hostedZoneForMain\n  },{\n    hostedZone: hostedZoneForAlternative,\n    validationRole: iam.Role.fromRoleArn(\n      this, 'SecondaryValidationRole', 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'\n    ),\n    validationExternalId: 'domain-assume'\n  }]\n})\n```\n"
   },
   "repository": {
     "type": "git",
@@ -3502,7 +3502,7 @@
       "assembly": "@trautonen/cdk-dns-validated-certificate",
       "base": "aws-cdk-lib.Resource",
       "docs": {
-        "example": "// # Cross-region certificate validation\n// hosted zone managed by the CDK application\nconst hostedZone: route53.IHostedZone = ...\n// no separate validation role is needed\nconst certificate = new DnsValidatedCertificate(this, 'CrossRegionCertificate', {\n  hostedZone: hostedZone,\n  domainName: 'example.com',     // must be compatible with the hosted zone\n  certificateRegion: 'us-east-1' // used by for example CloudFront\n})\n// # Cross-account certificate validation\n// external hosted zone\nconst hostedZone: route53.IHostedZone =\n  route53.HostedZone.fromHostedZoneAttributes(this, 'HostedZone', {\n    hostedZoneId: 'Z532DGDEDFS123456789',\n    zoneName: 'example.com'\n  })\n// validation role on the same account as the hosted zone\nconst roleArn = 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'\nconst externalId = 'domain-assume'\nconst validationRole: iam.IRole =\n  iam.Role.fromRoleArn(this, 'ValidationRole', roleArn)\nconst certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {\n  hostedZone: hostedZone,\n  domainName: 'example.com',\n  validationRole: validationRole,\n  validationExternalId: externalId\n})@resource[object Object]@resource[object Object]",
+        "example": "// ### Cross-region certificate validation\n// hosted zone managed by the CDK application\nconst hostedZone: route53.IHostedZone = ...\n// no separate validation role is needed\nconst certificate = new DnsValidatedCertificate(this, 'CrossRegionCertificate', {\n  domainName: 'example.com',     // must be compatible with the hosted zone\n  validationHostedZones: [{      // hosted zone used with the execution role's permissions\n    hostedZone: hostedZone\n  }],\n  certificateRegion: 'us-east-1' // used by for example CloudFront\n})\n// ### Cross-account certificate validation\n// external hosted zone\nconst hostedZone: route53.IHostedZone =\n  route53.HostedZone.fromHostedZoneAttributes(this, 'HostedZone', {\n    hostedZoneId: 'Z532DGDEDFS123456789',\n    zoneName: 'example.com'\n  })\n// validation role in the same account as the hosted zone\nconst roleArn = 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'\nconst externalId = 'domain-assume'\nconst validationRole: iam.IRole =\n  iam.Role.fromRoleArn(this, 'ValidationRole', roleArn)\nconst certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {\n  domainName: 'example.com',\n  validationHostedZones: [{\n    hostedZone: hostedZone,\n    validationRole: validationRole,\n    validationExternalId: externalId\n  }]\n})\n// ### Cross-account alternative name validation\n// example.com is validated on same account against managed hosted zone\n// and secondary.com is validated against external hosted zone on other account\nconst hostedZoneForMain: route53.IHostedZone = ...\nconst hostedZoneForAlternative: route53.IHostedZone =\n  route53.HostedZone.fromHostedZoneAttributes(this, 'SecondaryHostedZone', {\n    hostedZoneId: 'Z532DGDEDFS123456789',\n    zoneName: 'secondary.com'\n  })\nconst certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {\n  domainName: 'example.com',\n  alternativeDomainNames: ['secondary.com'],\n  validationHostedZones: [{\n    hostedZone: hostedZoneForMain\n  },{\n    hostedZone: hostedZoneForAlternative,\n    validationRole: iam.Role.fromRoleArn(\n      this, 'SecondaryValidationRole', 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'\n    ),\n    validationExternalId: 'domain-assume'\n  }]\n})@resource[object Object]@resource[object Object]",
         "remarks": "Will be automatically validated using DNS validation against the\nspecified Route 53 hosted zone. This construct should be used only for cross-region or cross-account certificate\nvalidations. The default ``Certificate`` construct is better in cases where everything is managed by the CDK\napplication.\n\nPlease note that this construct does not support alternative names yet as it would require domain to role mapping.",
         "stability": "stable",
         "summary": "A certificate managed by AWS Certificate Manager."
@@ -3515,7 +3515,7 @@
         },
         "locationInModule": {
           "filename": "src/dns-validated-certificate.ts",
-          "line": 181
+          "line": 213
         },
         "parameters": [
           {
@@ -3554,7 +3554,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/dns-validated-certificate.ts",
-        "line": 152
+        "line": 193
       },
       "methods": [
         {
@@ -3565,7 +3565,7 @@
           },
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 285
+            "line": 338
           },
           "name": "applyRemovalPolicy",
           "overrides": "aws-cdk-lib.Resource",
@@ -3586,7 +3586,7 @@
           },
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 273
+            "line": 326
           },
           "name": "metricDaysToExpiry",
           "overrides": "aws-cdk-lib.aws_certificatemanager.ICertificate",
@@ -3616,7 +3616,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 154
+            "line": 195
           },
           "name": "certificateArn",
           "overrides": "aws-cdk-lib.aws_certificatemanager.ICertificate",
@@ -3632,58 +3632,13 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 157
+            "line": 198
           },
           "name": "certificateRegion",
           "type": {
             "primitive": "string"
           }
         },
-        {
-          "docs": {
-            "stability": "stable",
-            "summary": "The domain name included in the certificate."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/dns-validated-certificate.ts",
-            "line": 166
-          },
-          "name": "domainName",
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "docs": {
-            "stability": "stable",
-            "summary": "The hosted zone identifier authoritative for the certificate."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/dns-validated-certificate.ts",
-            "line": 160
-          },
-          "name": "hostedZoneId",
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "docs": {
-            "stability": "stable",
-            "summary": "The hosted zone name authoritative for the certificate."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/dns-validated-certificate.ts",
-            "line": 163
-          },
-          "name": "hostedZoneName",
-          "type": {
-            "primitive": "string"
-          }
-        },
         {
           "docs": {
             "stability": "stable",
@@ -3692,7 +3647,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 169
+            "line": 201
           },
           "name": "tags",
           "overrides": "aws-cdk-lib.ITaggable",
@@ -3713,7 +3668,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/dns-validated-certificate.ts",
-        "line": 13
+        "line": 45
       },
       "name": "DnsValidatedCertificateProps",
       "properties": [
@@ -3727,7 +3682,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 19
+            "line": 51
           },
           "name": "domainName",
           "type": {
@@ -3737,18 +3692,46 @@
         {
           "abstract": true,
           "docs": {
-            "remarks": "If the hosted zone is not managed by the CDK application, it needs to be provided via\n``HostedZone.fromHostedZoneAttributes()``.",
+            "remarks": "Hosted zones are mapped to domain names by the zone name.",
             "stability": "stable",
-            "summary": "Hosted zone to use for DNS validation."
+            "summary": "List of hosted zones to use for validation."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 27
+            "line": 63
           },
-          "name": "hostedZone",
+          "name": "validationHostedZones",
           "type": {
-            "fqn": "aws-cdk-lib.aws_route53.IHostedZone"
+            "collection": {
+              "elementtype": {
+                "fqn": "@trautonen/cdk-dns-validated-certificate.ValidationHostedZone"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "May contain wildcards, such as ``*.otherdomain.com``.",
+            "stability": "stable",
+            "summary": "Fully-qualified alternative domain names to request a certificate for."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/dns-validated-certificate.ts",
+            "line": 58
+          },
+          "name": "alternativeDomainNames",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         },
         {
@@ -3762,7 +3745,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 37
+            "line": 73
           },
           "name": "certificateRegion",
           "optional": true,
@@ -3781,7 +3764,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 81
+            "line": 96
           },
           "name": "cleanupValidationRecords",
           "optional": true,
@@ -3793,14 +3776,14 @@
           "abstract": true,
           "docs": {
             "default": "- Lambda creates a default execution role.",
-            "remarks": "The role is given permissions to request certificates from ACM. If the ``validationRole`` is provided, this role\nis also given permission to assume the ``validationRole``. Otherwise it is assumed that the hosted zone is in same\naccount and the execution role is given permissions to change DNS records for the given ``domainName``.",
+            "remarks": "The role is given permissions to request certificates from ACM. If there are any ``validationRole``s provided,\nthis role is also given permission to assume the ``validationRole``. Otherwise it is assumed that the hosted zone\nis in same account and the execution role is given permissions to change DNS records for the given ``domainName``.",
             "stability": "stable",
             "summary": "The role that is used for the custom resource Lambda execution."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 48
+            "line": 84
           },
           "name": "customResourceRole",
           "optional": true,
@@ -3819,7 +3802,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 106
+            "line": 121
           },
           "name": "removalPolicy",
           "optional": true,
@@ -3839,18 +3822,52 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 93
+            "line": 108
           },
           "name": "transparencyLoggingEnabled",
           "optional": true,
           "type": {
             "primitive": "boolean"
           }
+        }
+      ],
+      "symbolId": "src/dns-validated-certificate:DnsValidatedCertificateProps"
+    },
+    "@trautonen/cdk-dns-validated-certificate.ValidationHostedZone": {
+      "assembly": "@trautonen/cdk-dns-validated-certificate",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "@trautonen/cdk-dns-validated-certificate.ValidationHostedZone",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/dns-validated-certificate.ts",
+        "line": 13
+      },
+      "name": "ValidationHostedZone",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The zone name is matched to domain name to use the right\nhosted zone for validation.\n\nIf the hosted zone is not managed by the CDK application, it needs to be provided via\n``HostedZone.fromHostedZoneAttributes()``.",
+            "stability": "stable",
+            "summary": "Hosted zone to use for DNS validation."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/dns-validated-certificate.ts",
+            "line": 21
+          },
+          "name": "hostedZone",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_route53.IHostedZone"
+          }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "- No external id provided during assume",
+            "default": "- No external id provided during assume.",
             "remarks": "This should be used only when ``validationRole`` is given and the role expects an external id provided on assume.",
             "stability": "stable",
             "summary": "External id for ``validationRole`` role assume verification."
@@ -3858,7 +3875,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 69
+            "line": 42
           },
           "name": "validationExternalId",
           "optional": true,
@@ -3877,7 +3894,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/dns-validated-certificate.ts",
-            "line": 60
+            "line": 33
           },
           "name": "validationRole",
           "optional": true,
@@ -3886,9 +3903,9 @@
           }
         }
       ],
-      "symbolId": "src/dns-validated-certificate:DnsValidatedCertificateProps"
+      "symbolId": "src/dns-validated-certificate:ValidationHostedZone"
     }
   },
-  "version": "0.0.53",
-  "fingerprint": "Nz4wDil2ESbu9HMFC/3b81w+akI0BaAKCwqC0jlLdGg="
+  "version": "0.1.1",
+  "fingerprint": "+qGmVidwojkTxQNNY77/hB6yNMdcWy84q70OhYgt860="
 }

package/API.md

@@ -1,10 +1,11 @@
 # AWS CDK DNS Validated Certificate
 
-CDK does not have a built in construct to manage cross-region or cross-account DNS validated certificates. There's an attempt to work around the issue with a cross region references option for stacks, but it has a lot of issues and still does not solve the cross-account use case.
+CDK does not have a built in construct to manage cross-region or cross-account DNS validated certificates. There's an
+attempt to work around the issue with a cross region references option for stacks, but it has a lot of issues and still
+does not solve the cross-account use case.
 
-This construct solves these problems by managing the certificate as a custom resource and with direct API calls to ACM and Route53. In the future it will be possible to support not only Route53, but other DNS services too.
-
-Currently there's a limitation which does not allow using alternative names for the certificate as it would require mapping of different roles to different hosted zones. This API is currently being developed.
+This construct solves these problems by managing the certificate as a custom resource and with direct API calls to ACM
+and Route53. In the future it will be possible to support not only Route53, but other DNS services too.
 
 ## Usage for cross-region validation
 
@@ -39,6 +40,32 @@ const certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate',
 })
 ```
 
+## Usage for cross-account alternative names validation
+
+```typescript
+// example.com is validated on same account against managed hosted zone
+// and secondary.com is validated against external hosted zone on other account
+const hostedZoneForMain: route53.IHostedZone = ...
+const hostedZoneForAlternative: route53.IHostedZone =
+  route53.HostedZone.fromHostedZoneAttributes(this, 'SecondaryHostedZone', {
+  hostedZoneId: 'Z532DGDEDFS123456789',
+  zoneName: 'secondary.com'
+})
+const certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {
+  domainName: 'example.com',
+  alternativeDomainNames: ['secondary.com'],
+  validationHostedZones: [{
+    hostedZone: hostedZoneForMain
+  },{
+    hostedZone: hostedZoneForAlternative,
+    validationRole: iam.Role.fromRoleArn(
+      this, 'SecondaryValidationRole', 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'
+    ),
+    validationExternalId: 'domain-assume'
+  }]
+})
+```
+
 # API Reference <a name="API Reference" id="api-reference"></a>
 
 ## Constructs <a name="Constructs" id="Constructs"></a>
@@ -59,32 +86,58 @@ Please note that this construct does not support alternative names yet as it wou
 *Example*
 
 ```typescript
-// # Cross-region certificate validation
+// ### Cross-region certificate validation
 // hosted zone managed by the CDK application
 const hostedZone: route53.IHostedZone = ...
 // no separate validation role is needed
 const certificate = new DnsValidatedCertificate(this, 'CrossRegionCertificate', {
-  hostedZone: hostedZone,
   domainName: 'example.com',     // must be compatible with the hosted zone
+  validationHostedZones: [{      // hosted zone used with the execution role's permissions
+    hostedZone: hostedZone
+  }],
   certificateRegion: 'us-east-1' // used by for example CloudFront
 })
-// # Cross-account certificate validation
+// ### Cross-account certificate validation
 // external hosted zone
 const hostedZone: route53.IHostedZone =
   route53.HostedZone.fromHostedZoneAttributes(this, 'HostedZone', {
     hostedZoneId: 'Z532DGDEDFS123456789',
     zoneName: 'example.com'
   })
-// validation role on the same account as the hosted zone
+// validation role in the same account as the hosted zone
 const roleArn = 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'
 const externalId = 'domain-assume'
 const validationRole: iam.IRole =
   iam.Role.fromRoleArn(this, 'ValidationRole', roleArn)
 const certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {
-  hostedZone: hostedZone,
   domainName: 'example.com',
-  validationRole: validationRole,
-  validationExternalId: externalId
+  validationHostedZones: [{
+    hostedZone: hostedZone,
+    validationRole: validationRole,
+    validationExternalId: externalId
+  }]
+})
+// ### Cross-account alternative name validation
+// example.com is validated on same account against managed hosted zone
+// and secondary.com is validated against external hosted zone on other account
+const hostedZoneForMain: route53.IHostedZone = ...
+const hostedZoneForAlternative: route53.IHostedZone =
+  route53.HostedZone.fromHostedZoneAttributes(this, 'SecondaryHostedZone', {
+    hostedZoneId: 'Z532DGDEDFS123456789',
+    zoneName: 'secondary.com'
+  })
+const certificate = new DnsValidatedCertificate(this, 'CrossAccountCertificate', {
+  domainName: 'example.com',
+  alternativeDomainNames: ['secondary.com'],
+  validationHostedZones: [{
+    hostedZone: hostedZoneForMain
+  },{
+    hostedZone: hostedZoneForAlternative,
+    validationRole: iam.Role.fromRoleArn(
+      this, 'SecondaryValidationRole', 'arn:aws:iam::123456789:role/ChangeDnsRecordsRole'
+    ),
+    validationExternalId: 'domain-assume'
+  }]
 })@resource[object Object]@resource[object Object]
 ```
 
@@ -256,9 +309,6 @@ Check whether the given construct is a Resource.
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.stack">stack</a></code> | <code>aws-cdk-lib.Stack</code> | The stack in which this resource is defined. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.certificateArn">certificateArn</a></code> | <code>string</code> | The certificate's ARN. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.certificateRegion">certificateRegion</a></code> | <code>string</code> | The region where the certificate is deployed to. |
-| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.domainName">domainName</a></code> | <code>string</code> | The domain name included in the certificate. |
-| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.hostedZoneId">hostedZoneId</a></code> | <code>string</code> | The hosted zone identifier authoritative for the certificate. |
-| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.hostedZoneName">hostedZoneName</a></code> | <code>string</code> | The hosted zone name authoritative for the certificate. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.tags">tags</a></code> | <code>aws-cdk-lib.TagManager</code> | The tag manager to set, remove and format tags for the certificate. |
 
 ---
@@ -330,42 +380,6 @@ The region where the certificate is deployed to.
 
 ---
 
-##### `domainName`<sup>Required</sup> <a name="domainName" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.domainName"></a>
-
-```typescript
-public readonly domainName: string;
-```
-
-- *Type:* string
-
-The domain name included in the certificate.
-
----
-
-##### `hostedZoneId`<sup>Required</sup> <a name="hostedZoneId" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.hostedZoneId"></a>
-
-```typescript
-public readonly hostedZoneId: string;
-```
-
-- *Type:* string
-
-The hosted zone identifier authoritative for the certificate.
-
----
-
-##### `hostedZoneName`<sup>Required</sup> <a name="hostedZoneName" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.hostedZoneName"></a>
-
-```typescript
-public readonly hostedZoneName: string;
-```
-
-- *Type:* string
-
-The hosted zone name authoritative for the certificate.
-
----
-
 ##### `tags`<sup>Required</sup> <a name="tags" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificate.property.tags"></a>
 
 ```typescript
@@ -396,14 +410,13 @@ const dnsValidatedCertificateProps: DnsValidatedCertificateProps = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.domainName">domainName</a></code> | <code>string</code> | Fully-qualified domain name to request a certificate for. |
-| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.hostedZone">hostedZone</a></code> | <code>aws-cdk-lib.aws_route53.IHostedZone</code> | Hosted zone to use for DNS validation. |
+| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.validationHostedZones">validationHostedZones</a></code> | <code><a href="#@trautonen/cdk-dns-validated-certificate.ValidationHostedZone">ValidationHostedZone</a>[]</code> | List of hosted zones to use for validation. |
+| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.alternativeDomainNames">alternativeDomainNames</a></code> | <code>string[]</code> | Fully-qualified alternative domain names to request a certificate for. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.certificateRegion">certificateRegion</a></code> | <code>string</code> | AWS region where the certificate is deployed. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.cleanupValidationRecords">cleanupValidationRecords</a></code> | <code>boolean</code> | Enable or disable cleaning of validation DNS records from the hosted zone. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.customResourceRole">customResourceRole</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The role that is used for the custom resource Lambda execution. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.removalPolicy">removalPolicy</a></code> | <code>aws-cdk-lib.RemovalPolicy</code> | Apply the given removal policy to this resource. |
 | <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.transparencyLoggingEnabled">transparencyLoggingEnabled</a></code> | <code>boolean</code> | Enable or disable transparency logging for this certificate. |
-| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.validationExternalId">validationExternalId</a></code> | <code>string</code> | External id for ``validationRole`` role assume verification. |
-| <code><a href="#@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.validationRole">validationRole</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The role that is assumed for DNS record changes for certificate validation. |
 
 ---
 
@@ -421,18 +434,31 @@ May contain wildcards, such as ``*.domain.com``.
 
 ---
 
-##### `hostedZone`<sup>Required</sup> <a name="hostedZone" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.hostedZone"></a>
+##### `validationHostedZones`<sup>Required</sup> <a name="validationHostedZones" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.validationHostedZones"></a>
 
 ```typescript
-public readonly hostedZone: IHostedZone;
+public readonly validationHostedZones: ValidationHostedZone[];
 ```
 
-- *Type:* aws-cdk-lib.aws_route53.IHostedZone
+- *Type:* <a href="#@trautonen/cdk-dns-validated-certificate.ValidationHostedZone">ValidationHostedZone</a>[]
 
-Hosted zone to use for DNS validation.
+List of hosted zones to use for validation.
 
-If the hosted zone is not managed by the CDK application, it needs to be provided via
-``HostedZone.fromHostedZoneAttributes()``.
+Hosted zones are mapped to domain names by the zone name.
+
+---
+
+##### `alternativeDomainNames`<sup>Optional</sup> <a name="alternativeDomainNames" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.alternativeDomainNames"></a>
+
+```typescript
+public readonly alternativeDomainNames: string[];
+```
+
+- *Type:* string[]
+
+Fully-qualified alternative domain names to request a certificate for.
+
+May contain wildcards, such as ``*.otherdomain.com``.
 
 ---
 
@@ -481,9 +507,9 @@ public readonly customResourceRole: IRole;
 
 The role that is used for the custom resource Lambda execution.
 
-The role is given permissions to request certificates from ACM. If the ``validationRole`` is provided, this role
-is also given permission to assume the ``validationRole``. Otherwise it is assumed that the hosted zone is in same
-account and the execution role is given permissions to change DNS records for the given ``domainName``.
+The role is given permissions to request certificates from ACM. If there are any ``validationRole``s provided,
+this role is also given permission to assume the ``validationRole``. Otherwise it is assumed that the hosted zone
+is in same account and the execution role is given permissions to change DNS records for the given ``domainName``.
 
 ---
 
@@ -524,14 +550,52 @@ effect. If you change this property after creation, a new certificate will be re
 
 ---
 
-##### `validationExternalId`<sup>Optional</sup> <a name="validationExternalId" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.validationExternalId"></a>
+### ValidationHostedZone <a name="ValidationHostedZone" id="@trautonen/cdk-dns-validated-certificate.ValidationHostedZone"></a>
+
+#### Initializer <a name="Initializer" id="@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.Initializer"></a>
+
+```typescript
+import { ValidationHostedZone } from '@trautonen/cdk-dns-validated-certificate'
+
+const validationHostedZone: ValidationHostedZone = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.property.hostedZone">hostedZone</a></code> | <code>aws-cdk-lib.aws_route53.IHostedZone</code> | Hosted zone to use for DNS validation. |
+| <code><a href="#@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.property.validationExternalId">validationExternalId</a></code> | <code>string</code> | External id for ``validationRole`` role assume verification. |
+| <code><a href="#@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.property.validationRole">validationRole</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The role that is assumed for DNS record changes for certificate validation. |
+
+---
+
+##### `hostedZone`<sup>Required</sup> <a name="hostedZone" id="@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.property.hostedZone"></a>
+
+```typescript
+public readonly hostedZone: IHostedZone;
+```
+
+- *Type:* aws-cdk-lib.aws_route53.IHostedZone
+
+Hosted zone to use for DNS validation.
+
+The zone name is matched to domain name to use the right
+hosted zone for validation.
+
+If the hosted zone is not managed by the CDK application, it needs to be provided via
+``HostedZone.fromHostedZoneAttributes()``.
+
+---
+
+##### `validationExternalId`<sup>Optional</sup> <a name="validationExternalId" id="@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.property.validationExternalId"></a>
 
 ```typescript
 public readonly validationExternalId: string;
 ```
 
 - *Type:* string
-- *Default:* No external id provided during assume
+- *Default:* No external id provided during assume.
 
 External id for ``validationRole`` role assume verification.
 
@@ -539,7 +603,7 @@ This should be used only when ``validationRole`` is given and the role expects a
 
 ---
 
-##### `validationRole`<sup>Optional</sup> <a name="validationRole" id="@trautonen/cdk-dns-validated-certificate.DnsValidatedCertificateProps.property.validationRole"></a>
+##### `validationRole`<sup>Optional</sup> <a name="validationRole" id="@trautonen/cdk-dns-validated-certificate.ValidationHostedZone.property.validationRole"></a>
 
 ```typescript
 public readonly validationRole: IRole;