Acme Aws Lambda

This gem allow to create, renew or revoke Letsencrypt certificate by using AWS Lambda, AWS Route53 and AWS S3.

Installation

Add this line to your application's Gemfile:

gem 'acme-aws-lambda'

And then execute:

$ bundle

Or install it yourself as:

$ gem install acme-aws-lambda

Usage

You need create file function.rb and add this to it (runtime: Ruby 2.7):

# this two lines fix problem with require gems in AWS lambda
load_paths = Dir["./vendor/bundle/ruby/2.7.0/bundler/gems/**/lib"]
$LOAD_PATH.unshift(*load_paths)
# require gem
require 'acme_aws_lambda'

AcmeAwsLambda.configure do |config|
  config.production_mode = true
  config.contact_email = 'admin@example.com'
  config.domains = ['example.com', '*.example.com']
  config.common_name = '*.example.com'
  config.s3_bucket = 'example.com-certificates'
  config.s3_certificates_key = 'certificates/example.com'
  config.route53_domain = 'example.com'
  config.after_success = -> (data) {
    puts data[:cert] # certificate
    puts data[:key] # private key
  }
end

def handler(event:, context:)
  AcmeAwsLambda.create_or_renew_cert
end

Next you need run in terminal:

$ bundle install --path vendor/bundle --clean
$ zip -r function.zip function.rb vendor

File function.zip need to be uploaded to AWS lambda.

In result AWS S3 will contain private key certificates/example.com.key and certificate certificates/example.com.crt

Configuration

Configuration params:

Name	Default	Variants	Description
log_level	`:info`	`:info`, `:debug`, `:warn`, `:error`	Log lever for app
log_formatter	`Logger::Formatter.new`	Any custom log formater	Log formater
production_mode	`false`	`true` or `false`	For testing purpose better to use staging acme server and only after success activate production
key_size	2048	2048, 4096, etc	Size for generated RSA private key
contact_email		email address	Email address for letsencrypt account
domains	[]	array of strings	List of a domains for certificate
common_name		domain, which should match one from `domains` list	Common name for certificate
renew	30	days	Max days for certificate expiration, when app start renew process
same_private_key_on_renew	`false`	`true` or `false`	Use same private key for certificate renew
dns_retry_timeout	`4`	seconds	Timeout between check dns changes
dns_retry_count	`15`	count	Max amount of DNS records check, before fail
cert_retry_timeout	`1`	seconds	Timeout between check certificates is ready
cert_retry_count	`10`	count	Max amount of certification ready check, before fail
after_success	`nil`	function	Hook, which will be executed, if function generated new or renew certificate
aws_access_key_id	`AWS_ACCESS_KEY_ID` environment variable		AWS access key for AWS S3 and Route53 access
aws_secret_access_key	`AWS_SECRET_ACCESS_KEY` environment variable		AWS secret access key for AWS S3 and Route53 access
aws_session_token	`AWS_SESSION_TOKEN` environment variable		AWS session token for AWS S3 and Route53 access (not required)
aws_region	`AWS_REGION` environment variable		AWS Region
s3_aws_access_key_id	fallback to `aws_access_key_id`		Change AWS access key for AWS S3
s3_aws_secret_access_key	fallback to `aws_secret_access_key`		Change AWS secret access key for AWS S3
s3_aws_session_token	fallback to `aws_session_token`		Change AWS session token for AWS S3
s3_aws_region	fallback to `aws_region`		Change AWS region for AWS S3
s3_bucket			AWS S3 bucket name to store acme client key and certificate
s3_client_key	`acme/client.pem`		Path on AWS S3 where to store and get Acme client key
s3_certificates_key			Path on AWS S3 where to store and get private key and certificate. Private key will get path `<s3_certificates_key>.key` and certificate will get path `<s3_certificates_key>.crt`
route53_aws_access_key_id	fallback to `aws_access_key_id`		Change AWS access key for AWS Route53
route53_aws_secret_access_key	fallback to `aws_secret_access_key`		Change AWS secret access key for AWS Route53
route53_aws_session_token	fallback to `aws_session_token`		Change AWS session token for AWS Route53
route53_aws_region	fallback to `aws_region`		Change AWS region for AWS Route53
route53_domain			Name for domain in AWS Route53, where will added records for Acme verification process. Ignored, if set `route53_hosted_zone_id`
route53_hosted_zone_id			Hosted Zone ID inside AWS Route53, where will added records for Acme verification process

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/railsware/acme-aws-lambda. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

License

The gem is available as open source under the terms of the MIT License.

Code of Conduct

Everyone interacting in the Acme Aws Lambda project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.

dsylla/acme-aws-lambda