Provision an ACM certificate

Icebreaker’s ALB and nginx ingress modes, and Lakekeeper’s browser-based UI, all need an ACM certificate ARN — see prerequisites step 5 for where each one is used. AWS Certificate Manager issues public TLS certificates at no charge for domains you control. ALB rejects most imported self-signed certificates, so a real DNS-validated certificate is the supported path for both evaluation and production.

The certificate must be in the same AWS region as your EKS cluster.

aws acm request-certificate --domain-name "*.yourdomain.com" --validation-method DNS --region <your-region>

The command returns a certificate ARN in the form arn:aws:acm:<region>:<account-id>:certificate/<uuid>. Save it — depending on where you’re using it, you’ll pass it to the Icebreaker Helm chart as agent.albCertificateArn, to the Lakekeeper Helm chart’s NLB annotations, or store it as a wildcard Secret for nginx ingress.

A wildcard certificate (*.yourdomain.com) is the simplest choice: it covers any subdomain, so you do not need a new certificate if you later add Data Servers on different subdomains.

ACM requires you to prove ownership of the domain before it issues the certificate. After requesting, retrieve the DNS record ACM needs you to add:

aws acm describe-certificate --certificate-arn <certificate-arn> --query 'Certificate.DomainValidationOptions[].ResourceRecord'

Add the returned CNAME record to your DNS zone. ACM polls for it automatically; certificates typically become ISSUED within a few minutes. Verify the status:

aws acm describe-certificate --certificate-arn <certificate-arn> --query 'Certificate.Status'