instead of deploying nginx+dehydrated using ansible; certificates can be obtained using a terraform module. See: https://registry.terraform.io/modules/USSBA/letsencrypt/aws/latest https://github.com/opencredo/letsencrypt-terraform/tree/master https://github.com/ooni/devops/issues/337