# ACM certificate for ALB HTTPS. Lookup only; do not mint. The issued wildcard
# already exists in the account (portal pattern).
#
# Bootstrap order if the listener is ever rebuilt from nothing:
#   1. Confirm an ISSUED certificate for local.acm_wildcard_domain exists.
#   2. Set attach_custom_domain=true and apply. Until the lookup finds ISSUED,
#      the plan fails closed.

data "aws_acm_certificate" "wildcard" {
  count       = var.attach_custom_domain ? 1 : 0
  domain      = local.acm_wildcard_domain
  statuses    = ["ISSUED"]
  most_recent = true
}