# @servicevic-oss/cdk-cleanup-certificate-validation-records

> This CDK construct takes care of cleaning up the orphaned Route53 CNAME validation records left behind when deleting a certificate that had DNS validation enabled.

Latest version **1.3.124** (published 2026-10-22) · MIT license · 0 weekly downloads

## Install

```sh
npm install @servicevic-oss/cdk-cleanup-certificate-validation-records
pnpm add @servicevic-oss/cdk-cleanup-certificate-validation-records
yarn add @servicevic-oss/cdk-cleanup-certificate-validation-records
bun add @servicevic-oss/cdk-cleanup-certificate-validation-records
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 1.3.124 |
| Published | 2026-10-22 |
| First published | 2024-02-17 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >= 24.14.0 |
| Dependencies | 4 |
| Unpacked size | 7.3 MB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 3 |
| Author | Service Victoria |
| Maintainers | msessa, nickiannelli, sv-platform-cicd |
| Keywords | cdk |

## Links

- npm: https://www.npmjs.com/package/@servicevic-oss/cdk-cleanup-certificate-validation-records
- Repository: https://github.com/sv-oss/cdk-cleanup-certificate-validation-records
- Homepage: https://github.com/sv-oss/cdk-cleanup-certificate-validation-records#readme
- Issues: https://github.com/sv-oss/cdk-cleanup-certificate-validation-records/issues
- npm.io page: https://npm.io/package/@servicevic-oss/cdk-cleanup-certificate-validation-records

## Dependencies (4)

- [@types/aws-lambda](https://npm.io/package/@types/aws-lambda.md) ^8.10.164
- [async-await-retry](https://npm.io/package/async-await-retry.md) ^2.1.0
- [@aws-sdk/client-acm](https://npm.io/package/@aws-sdk/client-acm.md) ^3.1155.0
- [@aws-sdk/client-route-53](https://npm.io/package/@aws-sdk/client-route-53.md) ^3.1155.0

## Recent versions

- 1.3.124 (latest) — 2026-10-22
- 1.3.123 — 2026-10-21
- 1.3.122 — 2026-10-20
- 1.3.121 — 2026-10-16
- 1.3.120 — 2026-10-15
- 1.3.119 — 2026-10-14
- 1.3.118 — 2026-10-13
- 1.3.117 — 2026-10-12
- 1.3.116 — 2026-10-10
- 1.3.115 — 2026-10-09
- 1.3.114 — 2026-10-08
- 1.3.113 — 2026-10-07
- 1.3.112 — 2026-10-06
- 1.3.111 — 2026-10-03
- 1.3.110 — 2026-10-02
- … 312 more at https://npm.io/package/@servicevic-oss/cdk-cleanup-certificate-validation-records/versions

## README

# cdk-cleanup-certificate-validation-records

This CDK construct takes care of cleaning up the orphaned Route53 CNAME validation records
left behind when deleting a certificate that had DNS validation enabled.

The issue is better explained here: https://github.com/aws/aws-cdk/issues/11201

## Usage

### With wrapper class

The simplest usage is via the wrapper class `CertificateWithCleanup`.

The class extends the standard `Certificate` construct and adds the cleanup automatically

```typescript
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { CertificateWithCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'

export class TestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: TestStackProps) {
    super(scope, id, props);

    zone = new cdk.aws_route53.PublicHostedZone(this, 'Zone', {
      zoneName: 'my.zone.net',
    });

    const cert1 = new CertificateWithCleanup(this, 'Cert', {
      domainName: `mydomain.${zone.zoneName}`,
      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
      subjectAlternativeNames: [
        `mydomain2.${zone.zoneName}`,
        `mydomain3.${zone.zoneName}`,
      ],
    });
  };
}
```

### Explicit instantiation

The construct can be instantiated explicitely to cleanup after a specific certificate

```typescript
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'

export class TestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: TestStackProps) {
    super(scope, id, props);

    zone = new cdk.aws_route53.PublicHostedZone(this, 'Zone', {
      zoneName: 'my.zone.net',
    });

    const cert1 = new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
      domainName: `mydomain.${zone.zoneName}`,
      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
      subjectAlternativeNames: [
        `mydomain2.${zone.zoneName}`,
        `mydomain3.${zone.zoneName}`,
      ],
    });
    const cert2 = new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
      domainName: `another.${zone.zoneName}`,
      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
    });

    new CertificateValidationRecordCleanup(this, `cleanup-${cert1.node.id}`, {
      certificate: cert1,
      hostedZone: zone,
    });

    new CertificateValidationRecordCleanup(this, `cleanup-${cert2.node.id}`, {
      certificate: cert2,
      hostedZone: zone,
    });
  };
}
```

### Implicit instantiation using Aspects with knowledge of the hosted zone

The construct can be instantiated automatically against any Certificate resource created within a stack
through the use of Aspects

In this example, we have knowledge of the hosted zone

```typescript
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'

export class TestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: TestStackProps) {
    super(scope, id, props);

    zone = new cdk.aws_route53.PublicHostedZone(this, 'Zone', {
      zoneName: 'my.zone.net',
    });

    new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
      domainName: `mydomain.${zone.zoneName}`,
      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
      subjectAlternativeNames: [
        `mydomain2.${zone.zoneName}`,
        `mydomain3.${zone.zoneName}`,
      ],
    });
    new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
      domainName: `another.${zone.zoneName}`,
      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
    });

    cdk.Aspects.of(this).add({
      visit: (c) => {
        if (c instanceof cdk.aws_certificatemanager.Certificate) {
          new CertificateValidationRecordCleanup(this, `cleanup-${c.node.id}`, {
            certificate: c,
            hostedZone: zone,
          });
        }
      },
    });
  };
}
```

### Implicit instantiation using Aspects without knowledge of the hosted zone

The construct can be instantiated automatically against any Certificate resource created within a stack
through the use of Aspects

In this example, we have no knowledge of the hosted zone used to validate the certificate so we use a bit of brute force to derive it from the Certificate L1 resource

```typescript
import * as cdk from 'aws-cdk-lib';
import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'

const app = new cdk.App();

const blackBoxStack = new BlackBoxStack(app, 'my-blackbox-stack');
  
cdk.Aspects.of(blackBoxStack).add({
  visit: (c) => {
    if (c instanceof cdk.aws_certificatemanager.Certificate) {
      const cfnRes = c.node.defaultChild as cdk.aws_certificatemanager.CfnCertificate;
      const valOpts = (cfnRes.domainValidationOptions as cdk.aws_certificatemanager.CfnCertificate.DomainValidationOptionProperty[])[0];

      new CertificateValidationRecordCleanup(c, `cleanup-${c.node.id}`, {
        certificate: c,
        hostedZone: cdk.aws_route53.HostedZone.fromHostedZoneId(c, `lookup-${c.node.id}`, valOpts.hostedZoneId!),
      });
    }
  },
});
```

---
_Source: https://npm.io/package/@servicevic-oss/cdk-cleanup-certificate-validation-records · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._