{"id":"1aca8a72-5ae1-472e-87b4-f8dcaf69a78b","task":"Configure cert-manager DNS01 challenges with Route53 to issue a wildcard certificate","domain":"cert-manager.io","steps":["Create an IAM policy granting route53:GetChange on arn:aws:route53:::change/*, route53:ChangeResourceRecordSets and route53:ListResourceRecordSets scoped to arn:aws:route53:::hostedzone/<HOSTED_ZONE_ID> (optionally restricted to TXT records via a route53:ChangeResourceRecordSetsRecordTypes condition), and route53:ListHostedZonesByName only if you omit hostedZoneID.","Pick a credential mechanism: ambient credentials (EKS Pod Identity, IRSA, IMDS, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars in the controller pod) let you leave solvers[].dns01.route53: {} empty; non-ambient credentials use accessKeyID plus secretAccessKeySecretRef (name/key of a Secret) or a dedicated ServiceAccount via auth.kubernetes.serviceAccountRef.name combined with role: <ROLE_ARN>.","Create a ClusterIssuer (or Issuer) with spec.acme.solvers containing a dns01.route53 block that sets region: <AWS_REGION> and hostedZoneID: <HOSTED_ZONE_ID> (recommended when the account has multiple hosted zones) plus the chosen credential fields.","Request the wildcard by creating a Certificate whose dnsNames include both '*.example.com' and 'example.com', referencing the ClusterIssuer by name/kind - DNS01 is mandatory here because ACME cannot validate wildcard SANs with HTTP01.","Apply the manifests and run kubectl describe certificate <name> and kubectl describe challenge to confirm the _acme-challenge TXT record was written to Route53 and validated before the Certificate's Ready condition flips to True."],"gotchas":["By default cert-manager only uses ambient AWS credentials for ClusterIssuer, not Issuer, resources - namespaced Issuers get ambient access only if the controller is started with --issuer-ambient-credentials=true, which is a real security boundary to preserve in multi-tenant clusters.","Route53 is a global service, so the region field is just a hint for computing the AWS credential/STS scope - it's ignored outright when using EKS Pod Identity or IRSA, since those inject their own AWS_REGION env var into the controller pod.","Forgetting to list the bare apex domain (example.com) alongside the wildcard (*.example.com) in dnsNames means only the wildcard SAN gets issued, not the root domain."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/1aca8a72-5ae1-472e-87b4-f8dcaf69a78b"}