Registry / aws / cdk-certbot-dns-route53

cdk-certbot-dns-route53

JSON →
library2.5.74pypypi✓ verified 85d ago

This Python AWS CDK construct automates the process of obtaining and renewing Let's Encrypt SSL/TLS certificates using Certbot. It leverages AWS Lambda to run Certbot, Route53 for DNS-01 challenges, and stores the certificates in an S3 bucket. The current version is 2.5.18, with releases occurring periodically to support new CDK features and bug fixes.

pip install cdk-certbot-dns-route53
INSTALL
IMPORT
SIG · CDK-CERTBOT-DNS-RO
C
cdk-certbot-dns-route53
awspythonv2.5.74
Install
18.2s avg
Import
Disk
397MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v2.5.74 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 359.6MB
glibc
py 3.103.920 runs
installs and imports cleanly · install 18.2s · import 0.000s · 360MB
397MB installed
● package 397MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

CertbotDnsRoute53JobPython
from cdk_certbot_dns_route53 import CertbotDnsRoute53JobPython
from cdk_certbot_dns_route53.constructs import CdkCertbotDnsRoute53

This quickstart demonstrates how to integrate the `CdkCertbotDnsRoute53` construct into an AWS CDK application. Replace the placeholder values for `domain_name`, `hosted_zone_id`, and `certbot_email` with your actual domain information. The example assumes `CDK_DEFAULT_ACCOUNT` and `CDK_DEFAULT_REGION` are set in your environment, but provides fallback placeholders. After synthesizing, deploy the stack using `cdk deploy CertbotStack`.

import os from aws_cdk import App, Stack, Environment from cdk_certbot_dns_route53.constructs import CdkCertbotDnsRoute53 # AWS environment details. For production, ensure these are correctly configured. # The AWS account and region for deployment. Using default placeholders for demonstration. account = os.environ.get("CDK_DEFAULT_ACCOUNT", "123456789012") # Replace with your AWS Account ID region = os.environ.get("CDK_DEFAULT_REGION", "us-east-1") # Replace with your AWS Region app = App() env_config = Environment(account=account, region=region) stack = Stack( app, "CertbotStack", env=env_config, description="A stack for managing Certbot with Route53 and S3.", ) # Instantiate the CdkCertbotDnsRoute53 construct CdkCertbotDnsRoute53( stack, "CertbotConstruct", domain_name="your-actual-domain.com", # REQUIRED: Replace with your actual domain name hosted_zone_id="Z1ABCD2EFGHIJ3KLMNO4", # REQUIRED: Replace with your Hosted Zone ID for the domain certbot_email="admin@your-actual-domain.com", # REQUIRED: Replace with your email for Certbot notifications # sns_topic_arn="arn:aws:sns:REGION:ACCOUNT_ID:certbot-notifications", # OPTIONAL: Uncomment and replace for SNS notifications ) app.synth() # To deploy this stack, navigate to the directory containing this code and run: # cdk deploy CertbotStack --require-approval never
Debug
Known issues
breakingThis library is built for AWS CDK v2. Attempting to use it with a CDK v1 project will result in breaking changes and deployment failures due to API differences.
fix
Ensure your project uses `aws-cdk-lib` (CDK v2) and `constructs>=10.0.0`. If migrating from v1, consult the official AWS CDK v2 migration guide.
affects: < 2.0.0 (for this library), all CDK v1 projects.
gotchaThe AWS IAM user/role deploying the stack requires specific permissions for Route53 (to manage DNS records), S3 (to store certificates), Lambda (to create and execute the Certbot function), and EventBridge (for scheduled certificate renewal). Missing permissions will cause `cdk deploy` to fail with `AccessDenied` errors.
fix
Grant the necessary IAM permissions. Refer to the library's GitHub README for a detailed list of required permissions or start with broader permissions (e.g., `Route53FullAccess`, `S3FullAccess`, `LambdaFullAccess`, `EventBridgeFullAccess`) during development and narrow them down for production.
affects: All versions
gotchaThe `domain_name`, `hosted_zone_id`, and `certbot_email` properties are mandatory. Providing incorrect or non-existent values for `domain_name` or `hosted_zone_id` will lead to deployment errors or certificate issuance failures.
fix
Double-check that `domain_name` is your actual domain and `hosted_zone_id` corresponds to the correct Route53 hosted zone in your AWS account and region. Ensure a valid email is provided for `certbot_email` to receive renewal notifications from Let's Encrypt.
affects: All versions
gotchaLet's Encrypt has strict rate limits for certificate issuance. Repeatedly requesting certificates for the same domain or subdomain in a short period can lead to temporary blocks, especially during development and testing.
fix
During testing, consider using Let's Encrypt's staging environment if available (not directly supported by this construct out-of-the-box, but a general Certbot consideration), or ensure you are not hitting the rate limits by waiting between attempts or reusing existing certificates for testing purposes.
affects: All versions
Upgrade
Version history
2.5.74latest on PyPI · released Jun 13, 2026
Audit
Dependencies
aws-cdk-librequiredCore AWS CDK library, required for all CDK constructs.
constructsrequiredRequired for defining CDK constructs.
Agent activity
11 hits · last 30 days
node
10
OpenAI (training)
1
Resources