diff --git a/acmpca/README.md b/acmpca/README.md
index 7ab62c0..51f9aed 100644
--- a/acmpca/README.md
+++ b/acmpca/README.md
@@ -83,11 +83,11 @@ No modules.
 | <a name="input_certificate_cn"></a> [certificate\_cn](#input\_certificate\_cn) | CommonName (CN) to use for certificate, defaults in c=US,o=U.S. Census Bureau,ou=Servers. This will typically be the DNS name.  Uses certificate\_dns if not provided. | `string` | `null` | no |
 | <a name="input_certificate_dns"></a> [certificate\_dns](#input\_certificate\_dns) | DNS Name to be used for the certificate.  One of certificate\_dns or certificate\_cn must be provided. | `string` | `null` | no |
 | <a name="input_certificate_filename"></a> [certificate\_filename](#input\_certificate\_filename) | Filename for Certificate. Defaults to {certificate\_dns}.crt | `string` | `null` | no |
-| <a name="input_certificate_ip_addresses"></a> [certificate\_ip\_addresses](#input\_certificate\_ip\_addresses) | List of IP Addresses to be used in the CSR.  It is not recommended to use this for any service with auto-assigned addressing. | `string` | `[]` | no |
+| <a name="input_certificate_ip_addresses"></a> [certificate\_ip\_addresses](#input\_certificate\_ip\_addresses) | List of IP Addresses to be used in the CSR.  It is not recommended to use this for any service with auto-assigned addressing. | `list(string)` | `[]` | no |
 | <a name="input_certificate_san"></a> [certificate\_san](#input\_certificate\_san) | The Subject Alternate Names (SAN), a list of FQDNs to include in the ACM Certificate. Only DNS names are supported.  See docs at https://docs.aws.amazon.com/cli/latest/reference/acm/request-certificate.html | `list(string)` | `[]` | no |
 | <a name="input_certificate_subject_overrides"></a> [certificate\_subject\_overrides](#input\_certificate\_subject\_overrides) | Map of c, o, and ou to override certificate signing request settings.  Note that only a single OU is permitted. | `map(string)` | `{}` | no |
 | <a name="input_certificate_type"></a> [certificate\_type](#input\_certificate\_type) | Selection of type of certificate, either end-entity or subordinate-ca.  Note that the subordinate-ca type is not available for the short lived CA mode | `string` | `"end-entity"` | no |
-| <a name="input_certificate_uris"></a> [certificate\_uris](#input\_certificate\_uris) | List of URIs to be used in the CSR. | `string` | `[]` | no |
+| <a name="input_certificate_uris"></a> [certificate\_uris](#input\_certificate\_uris) | List of URIs to be used in the CSR. | `list(string)` | `[]` | no |
 | <a name="input_contact_email"></a> [contact\_email](#input\_contact\_email) | Email address in @census.gov of contact for the certificate.  This is strongly recommended to be a group email address. | `string` | n/a | yes |
 | <a name="input_create_files"></a> [create\_files](#input\_create\_files) | Flag controlling the creation of output files for the key, CSR, and certificate and bundle. | `bool` | `false` | no |
 | <a name="input_csr_filename"></a> [csr\_filename](#input\_csr\_filename) | Filename for Certificate Signing Request (CSR). Defaults to {certificate\_dns}.csr | `string` | `null` | no |
diff --git a/acmpca/variables.tf b/acmpca/variables.tf
index 3864104..55c0077 100644
--- a/acmpca/variables.tf
+++ b/acmpca/variables.tf
@@ -24,13 +24,13 @@ variable "certificate_cn" {
 
 variable "certificate_ip_addresses" {
   description = "List of IP Addresses to be used in the CSR.  It is not recommended to use this for any service with auto-assigned addressing."
-  type        = string
+  type        = list(string)
   default     = []
 }
 
 variable "certificate_uris" {
   description = "List of URIs to be used in the CSR."
-  type        = string
+  type        = list(string)
   default     = []
 }