feat: DNS provisioning updates#218
Open
aliziel wants to merge 2 commits into
Open
Conversation
aliziel
commented
May 9, 2026
Comment on lines
-70
to
+83
| route53_records = { | ||
| A = { | ||
| name = "api" | ||
| type = "A" | ||
| zone_id = data.aws_route53_zone.ecs_domain.id | ||
| } | ||
| } | ||
|
|
||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_route53_record" "atlas_assistant_api" { | ||
| provider = aws.dns | ||
| zone_id = data.aws_route53_zone.ecs_domain.zone_id | ||
| name = var.api_subdomain | ||
| type = "A" | ||
| alias { | ||
| name = module.alb.dns_name | ||
| zone_id = module.alb.zone_id | ||
| evaluate_target_health = true | ||
| } |
Collaborator
Author
There was a problem hiding this comment.
Previously, the api portion of api.atlas-assistant.ds.io was automatically created by the load balancer module, which assumes DNS lives in the same account.
Provisioning separately allows explicit reference to another provider (account).
aliziel
commented
May 9, 2026
Comment on lines
+18
to
+39
| validation_method = "DNS" | ||
| create_route53_records = false | ||
| validation_record_fqdns = module.route53_validation.validation_route53_record_fqdns | ||
| } | ||
|
|
||
| module "route53_validation" { | ||
| source = "terraform-aws-modules/acm/aws" | ||
| version = "~> 6.2.0" | ||
|
|
||
| providers = { | ||
| aws = aws.dns | ||
| } | ||
|
|
||
| create_certificate = false | ||
| create_route53_records_only = true | ||
| validation_method = "DNS" | ||
|
|
||
| zone_id = data.aws_route53_zone.ecs_domain.zone_id | ||
| distinct_domain_names = module.acm.distinct_domain_names | ||
|
|
||
| acm_certificate_domain_validation_options = module.acm.acm_certificate_domain_validation_options | ||
| } |
Collaborator
Author
There was a problem hiding this comment.
Similar to #218 (comment), the certificate manager module automatically handles DNS validation, but assumes the certificate is being issued in the DNS authority account.
Using same module and pointing to separate accounts to propagate DNS validation to correct place.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Pre-transfer, the
atlas-assistant.ds.iohosted zone was owned by the project account (subdomain delegated authority). The DNS records to be used post-transfer are managed in a separate AWS account, which changes the build requirements.AWS needs a certificate in the account where its being used, i.e. a domain used in multiple accounts can't 'share' a certificate through remote lookups.
One option is to import a certificate, which comes with some maintenance overhead (plus additional charges for AWS-issued certificates). Another option is to request a new certificate for the domain in each region or account needed, which is what we're doing here.
Description
Shorthand to help outline changes:
Account A= transferred project account ending in-9759Account B= AWS account that owns the relevant Route 53 records (i.e. DNS authority foradaptationatlas.cgiar.org)Account B's Route 53 records1Account Aunless specifically configuredAccount Bto provision certificateAccount Bhosted zoneatlas-assistant-apialias/A record toAccount Bhosted zone, routing toAccount Aload balancerLet me know if modifications are needed based on the inferred DNS setup.
Note
Create role in authoritative DNS account and add to environment before merging, see below1
Footnotes
A role will need to be created in
Account Band plugged into theDNS_ACCOUNT_ROLE_ARNGitHub Actions variable- The role should have Route 53 write access
- The trust policy should allow
Account Ato assume the role ↩ ↩2