Terraform AWS Provider 5.0 ACM DNS Validation Compatibility Boundary for External DNS

Precise Goal

You need to manage AWS ACM certificate DNS validation for domains hosted outside Route53 entirely within Terraform, using the AWS provider version 5.x or later.

Constraints and Uncertainty

The aws_acm_certificate resource supports DNS validation, but the provider does not automatically create the required CNAME record in non-Route53 DNS services such as Cloudflare or Azure DNS. The companion aws_acm_certificate_validation resource manages the record only when the zone is in Route53. There is an unresolved design question about whether the provider should infer validation records for any DNS provider exposing a Terraform-compatible API, but no consensus or implementation exists.

Additionally, the provider documentation states that DNS validation records are purged only when the validation resource is destroyed. If the certificate resource is destroyed independently, stale CNAME records may remain. Switching a certificate from DNS to EMAIL validation forces replacement of the certificate resource.

Unresolved Questions

1. Should the AWS provider automatically manage validation CNAME records for non-Route53 DNS providers, or is that intentionally left to external automation?
2. What is the recommended lifecycle pattern to ensure validation records are cleaned up when the certificate is destroyed without direct provider support?
3. Does the current provider version offer any configuration boundary or preview feature that changes this behavior for external DNS zones?