Back to notes
• 3 min read

Deploying the Certificate with Git Sync

You have a certificate template and a role scoped to it. Time to deploy. This post connects your GitHub repo to CloudFormation and deploys the cert stack with Sync from Git.

The Repo

Your repo needs two files for this stack: the certificate template from post 3 and a deployment file that tells CloudFormation where to find it.

repo/
  infra.yaml
  deployment-file.yaml

See the full template on GitHub: infra.yaml.

The deployment file is short:

template-file-path: infra.yaml
parameters:
  HostedZoneId: your-hostedzone-id

template-file-path points to your CloudFormation template relative to the repo root. parameters passes values into the template.

HostedZoneId is the hosted zone ID for your domain. Find it in the AWS console: Route 53 > Hosted zones > your domain > Hosted zone details.

CodeConnection

CloudFormation needs a connection to read your GitHub repo. You already created one in post 2 and completed the GitHub handshake. That same connection works for every stack you deploy with Git Sync.

Creating the Stack

Now you create the stack with Git Sync enabled.

  1. Go to CloudFormation > Create stack and choose Sync from Git.
  2. Select the CodeConnection from post 2.
  3. Enter your repository name, branch (main), and the deployment file path (deployment-file.yaml).
  4. Select the IAM role (CloudFormationGitSyncRole from post 4).
  5. CloudFormation reads the deployment file, finds the template, and starts the deployment.

What Happens Next

Once the stack starts creating:

  • CloudFormation builds a change set from the template.
  • ACM requests the certificate for your domain.
  • Route 53 writes the DNS validation CNAME records into your hosted zone.
  • ACM validates domain ownership and issues the certificate.

Certificate validation can take a few minutes. The stack stays in CREATE_IN_PROGRESS until ACM finishes. Once it does, the stack moves to CREATE_COMPLETE and your certificate is live.

Updating on Push

Now that Git Sync is connected, pushing template changes to your repo triggers automatic redeployment. Edit a template, push to main, and CloudFormation picks it up. No CLI commands, no console clicking.