Route 53, DNS and ACM Certificates

export DOMAIN=example.com

# Public zone
ZONE_ID=$(aws route53 create-hosted-zone --name "$DOMAIN" \
  --caller-reference "bookshelf-$(date +%s)" \
  --query 'HostedZone.Id' --output text | cut -d/ -f3)
aws route53 get-hosted-zone --id "$ZONE_ID" --query 'DelegationSet.NameServers'   # give these to the registrar

# Private zone, associated with the Bookshelf VPC
PRIVATE_ZONE_ID=$(aws route53 create-hosted-zone --name bookshelf.internal \
  --caller-reference "bookshelf-private-$(date +%s)" \
  --vpc VPCRegion=us-east-1,VPCId="$VPC_ID" \
  --hosted-zone-config Comment="Bookshelf internal names",PrivateZone=true \
  --query 'HostedZone.Id' --output text | cut -d/ -f3)

# Cross-account (or cross-Region) association: authorize from the zone's account, associate from the VPC's account
aws route53 create-vpc-association-authorization --hosted-zone-id "$PRIVATE_ZONE_ID" \
  --vpc VPCRegion=us-east-1,VPCId="$OTHER_VPC_ID"
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id "$PRIVATE_ZONE_ID" \
  --vpc VPCRegion=us-east-1,VPCId="$OTHER_VPC_ID"          # run with the other account's credentials

aws ec2 modify-vpc-attribute --vpc-id "$VPC_ID" --enable-dns-support '{"Value":true}'
aws ec2 modify-vpc-attribute --vpc-id "$VPC_ID" --enable-dns-hostnames '{"Value":true}'

# Alias target values: CloudFront has the fixed zone ID Z2FDTNDATAQYW2; load balancers have a per-Region ID
read ALB_DNS ALB_ZONE < <(aws elbv2 describe-load-balancers --names alb-bookshelf \
  --query 'LoadBalancers[0].[DNSName,CanonicalHostedZoneId]' --output text)

cat > records.json <<EOF
{
  "Comment": "Bookshelf public names",
  "Changes": [
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "www.example.com", "Type": "A",
        "AliasTarget": { "HostedZoneId": "Z2FDTNDATAQYW2", "DNSName": "$CF_DOMAIN", "EvaluateTargetHealth": false } } },
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "www.example.com", "Type": "AAAA",
        "AliasTarget": { "HostedZoneId": "Z2FDTNDATAQYW2", "DNSName": "$CF_DOMAIN", "EvaluateTargetHealth": false } } },
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "api.example.com", "Type": "A",
        "AliasTarget": { "HostedZoneId": "$ALB_ZONE", "DNSName": "$ALB_DNS", "EvaluateTargetHealth": true } } },
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "status.example.com", "Type": "CNAME", "TTL": 300,
        "ResourceRecords": [ { "Value": "bookshelf.statuspage.example.net" } ] } }
  ]
}
EOF
CHANGE_ID=$(aws route53 change-resource-record-sets --hosted-zone-id "$ZONE_ID" \
  --change-batch file://records.json --query ChangeInfo.Id --output text)
aws route53 wait resource-record-sets-changed --id "$CHANGE_ID"

aws route53 list-resource-record-sets --hosted-zone-id "$ZONE_ID" \
  --query "ResourceRecordSets[?Type=='A'].[Name,AliasTarget.DNSName]" --output table
aws route53 test-dns-answer --hosted-zone-id "$ZONE_ID" --record-name api.example.com --record-type A
dig +short api.example.com

# Weighted canary: 95 to the current load balancer, 5 to the new one
cat > weighted.json <<EOF
{
  "Changes": [
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "api.example.com", "Type": "A", "SetIdentifier": "current", "Weight": 95,
        "AliasTarget": { "HostedZoneId": "$ALB_ZONE", "DNSName": "$ALB_DNS", "EvaluateTargetHealth": true } } },
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "api.example.com", "Type": "A", "SetIdentifier": "canary", "Weight": 5,
        "AliasTarget": { "HostedZoneId": "$NEW_ALB_ZONE", "DNSName": "$NEW_ALB_DNS", "EvaluateTargetHealth": true } } }
  ]
}
EOF
aws route53 change-resource-record-sets --hosted-zone-id "$ZONE_ID" --change-batch file://weighted.json

cat > health-check.json <<'EOF'
{
  "Type": "HTTPS",
  "FullyQualifiedDomainName": "api.example.com",
  "Port": 443,
  "ResourcePath": "/actuator/health",
  "RequestInterval": 30,
  "FailureThreshold": 3,
  "EnableSNI": true
}
EOF
HC_ID=$(aws route53 create-health-check --caller-reference "bookshelf-api-$(date +%s)" \
  --health-check-config file://health-check.json --query HealthCheck.Id --output text)
aws route53 update-health-check --health-check-id "$HC_ID" --failure-threshold 2
aws route53 get-health-check-status --health-check-id "$HC_ID" \
  --query 'HealthCheckObservations[].[Region,StatusReport.Status]' --output table

OUT_ID=$(aws route53resolver create-resolver-endpoint --creator-request-id bookshelf-out \
  --name bookshelf-outbound --direction OUTBOUND --security-group-ids "$RESOLVER_SG_ID" \
  --ip-addresses SubnetId="$PRIVATE_SUBNET_A" SubnetId="$PRIVATE_SUBNET_B" \
  --query ResolverEndpoint.Id --output text)
RULE_ID=$(aws route53resolver create-resolver-rule --creator-request-id bookshelf-corp \
  --name corp-forward --rule-type FORWARD --domain-name corp.example.com \
  --resolver-endpoint-id "$OUT_ID" --target-ips Ip=10.20.0.2,Port=53 \
  --query ResolverRule.Id --output text)
aws route53resolver associate-resolver-rule --resolver-rule-id "$RULE_ID" --vpc-id "$VPC_ID" --name bookshelf-corp

aws route53resolver create-resolver-endpoint --creator-request-id bookshelf-in \
  --name bookshelf-inbound --direction INBOUND --security-group-ids "$RESOLVER_SG_ID" \
  --ip-addresses SubnetId="$PRIVATE_SUBNET_A" SubnetId="$PRIVATE_SUBNET_B"

aws route53globalresolver list-global-resolvers --region us-east-2

aws route53domains check-domain-availability --region us-east-1 --domain-name example.com
aws route53domains get-domain-detail --region us-east-1 --domain-name example.com \
  --query '[DomainName,AutoRenew,TransferLock,ExpirationDate,Nameservers[].Name]'

# Placeholder contact details in contact.json; registration is billed and not refundable
aws route53domains register-domain --region us-east-1 --domain-name example.com \
  --duration-in-years 1 --auto-renew \
  --admin-contact file://contact.json --registrant-contact file://contact.json --tech-contact file://contact.json
aws route53domains list-operations --region us-east-1 --status IN_PROGRESS

CERT_ARN=$(aws acm request-certificate --region us-east-1 \
  --domain-name "$DOMAIN" --subject-alternative-names "*.$DOMAIN" \
  --validation-method DNS --tags Key=app,Value=bookshelf \
  --query CertificateArn --output text)

# The validation record appears a few seconds after the request
aws acm describe-certificate --region us-east-1 --certificate-arn "$CERT_ARN" \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord' > validation-record.json

jq '{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:.Name,Type:.Type,TTL:300,ResourceRecords:[{Value:.Value}]}}]}' \
  validation-record.json > validation-change.json
aws route53 change-resource-record-sets --hosted-zone-id "$ZONE_ID" --change-batch file://validation-change.json

aws acm wait certificate-validated --region us-east-1 --certificate-arn "$CERT_ARN"
aws acm describe-certificate --region us-east-1 --certificate-arn "$CERT_ARN" \
  --query 'Certificate.[Status,RenewalEligibility,NotAfter,InUseBy]'
aws acm list-certificates --region us-east-1 \
  --query 'CertificateSummaryList[].[DomainName,Status,CertificateArn]' --output table

Parameters:
  HostedZoneId: { Type: AWS::Route53::HostedZone::Id }
  LoadBalancerDnsName: { Type: String }
  LoadBalancerHostedZoneId: { Type: String }
Resources:
  Certificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: api.example.com
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: api.example.com
          HostedZoneId: !Ref HostedZoneId
  ApiRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: api.example.com
      Type: A
      AliasTarget:
        DNSName: !Ref LoadBalancerDnsName
        HostedZoneId: !Ref LoadBalancerHostedZoneId
        EvaluateTargetHealth: true
Outputs:
  CertificateArn:
    Value: !Ref Certificate