Two-Phase ACM Validation with External DNS

Sun, 15 Mar 2026 00:00:00 +0000

The deadlock

A CloudFront distribution with a custom domain needs an issued ACM certificate in us-east-1. ACM issues a DNS-validated certificate only after a specific CNAME appears in the domain’s zone.¹ When Terraform owns the zone, it writes that record in the same apply. When the zone is external, Terraform cannot — and a single apply that both requests the certificate and builds the distribution cannot complete, because:

Security on Prosyon Research

Two-Phase ACM Validation with External DNS

The deadlock