Support for Route 53 DNSSEC

[gazoakley]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Today, Amazon Web Services announced the launch of Domain Name System Security Extensions (DNSSEC) for Amazon Route 53. You can now enable DNSSEC signing for all existing and new public hosted zones, and enable DNSSEC validation for Amazon Route 53 Resolver. Amazon Route 53 DNSSEC provides data origin authentication and data integrity verification for DNS and can help customers meet compliance mandates, such as FedRAMP.

When you enable DNSSEC signing on a hosted zone, Route 53 cryptographically signs each record in that hosted zone. Route 53 manages the zone-signing key, and you can manage the key-signing key in AWS Key Management Service (AWS KMS). Amazon’s domain name registrar, Route 53 Domains, already supports DNSSEC, and customers can now register domains and host their DNS on Route 53 with DNSSEC signing enabled.

New or Affected Resource(s)

• aws_route53_zone
• aws_route53_key_signing_key

Potential Terraform Configuration

resource "aws_route53_zone" "example" {
  name = "example.com"
}

resource "aws_route53_key_signing_key" "example" {
  hosted_zone_id             = aws_route53_zone.example.id
  key_management_service_arn = aws_kms_key.example.arn
  name                       = "example_key"
  status                     = "ACTIVE"
}

resource "aws_route_53_zone_dnssec_enablement" "example" {
  depends_on     = [aws_route53_key_signing_key.example]
  hosted_zone_id = aws_route53_zone.example.id
}

resource "aws_kms_key" "example" {
  customer_master_key_spec = "ECC_NIST_P256"
  key_usage                = "SIGN_VERIFY"
  policy                   = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = [
      "kms:DescribeKey",
      "kms:GetPublicKey",
      "kms:Sign",
    ]
    resources = ["*"]

    principals {
      type        = "Service"
      identifiers = ["api-service.dnssec.route53.aws.internal"]
    }
  }
}

References

• https://aws.amazon.com/about-aws/whats-new/2020/12/announcing-amazon-route-53-support-dnssec/

[bflad]

Might also be good to create a separate issue for managing Route 53 Resolver DNSSEC: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dnssec-validation.html (backed by APIs like UpdateResolverDnssecConfig)

Available here: #16837

[bflad]

Will merge in the required AWS Go SDK version 1.36.11 update after we cut today's release. I should be able to get the aws_route53_key_signing_key resource implementation up later today, but please note that it will most likely not be released until after the new year due to our annual holiday break.

[Sohaib112]

When should we expect this to be available?

[bflad]

The first part of this, an aws_route53_key_signing_key managed resource, has been merged and will release with version 3.27.0 of the Terraform AWS Provider later today. The next piece for managing Route 53 Hosted Zone DNSSEC configuration will be submitted in the next few days. Once that support is in, we can end-to-end test managing DS record set types.

[bflad]

Support for a new aws_route53_hosted_zone_dnssec resource and DS record type support in the aws_route53_record resource has been merged. These features will release in version 3.31.0 of the Terraform AWS Provider, later this week. 👍

[ghost]

This has been released in version 3.31.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!