I am attempting to use the CloudFormation template for a new VPC and workload as provided within https://aws-quickstart.s3.amazonaws.com/quickstart-hashicorp-vault/doc/hashicorp-vault-on-the-aws-cloud.pdf to create a vault cluster. However, I am seeing the following:
VaultServerListener HTTPS CREATE_FAILED Certificate ARN '' is not valid (Service: AmazonElasticLoadBalancingV2; Status Code: 400; Error Code: ValidationError; Request ID: 650c7ca1-0abe-4bae-9b30-d114c220423d)
Make sure that the certificate ARN is in the same region as the load balancer.
Based on your additional info, it seems that the error originates here:
VaultServerListenerHTTPS:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
Certificates:
- CertificateArn: !If [ CreateDns, !GetAtt "ACMCertificate.Outputs.ACMCertificate", !Ref ACMSSLCertificateArn ]
Your comments indicate that there is no ACM certificate setup. However, if you look at the code above, an ACM certificate must be provided.
Either you create your own ACM certificate and provide its arn in ACMSSLCertificateArn parameter, or let the template create one for you using this template.
For the ACM certificate, you need to have a custom domain, for example setup in Route53.
From only Error looks like you are using the wrong cloudformation resource. The Type of an application load balancer is AWS::ElasticLoadBalancingV2::LoadBalancer. It has V2 on the end. And the one you are probably using is AWS::ElasticLoadBalancing::LoadBalancer and that creates a classic load balancer.
The error you are getting is due to the difference in the return values for Ref function between classic LB and application LB. But if you post your code I can help more :D