feat(route53): DNSSEC zone signing#28604
Conversation
|
|
||
| constructor(scope: Construct, id: string, props: KeySigningKeyProps) { | ||
| super(scope, id, { | ||
| physicalName: props.keySigningKeyName ?? Lazy.string({ |
There was a problem hiding this comment.
We should add validation for keySigningKeyName according to the docs.
There was a problem hiding this comment.
I don't actually love doing this because if the service team changes this, we have to make an additional code change to allow customers to use the new pattern as well. I tend to think that the deploy time validation should be good enough in this case.
Another option I've been considering is trying to add something into our overall validation at synth that takes in any of these patterns and checks against it, but that's much much larger project than this.
| }); | ||
| // The KSK must exist and be in an 'ACTIVE' status before DNSSEC can be enabled. | ||
| dnssec.addDependency(this.keySigningKey.node.defaultChild as CfnKeySigningKey); | ||
| return this.keySigningKey; |
There was a problem hiding this comment.
Do we need to return the key? 🤔
|
@kylelaker This one looks really close. Want to address @lpizzinidev comments? I can help get it over the finish line if you're swamped. |
aws-cdk-automation
left a comment
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
DNSSEC zone signing
TheRealAmazonKendra
left a comment
There was a problem hiding this comment.
Given that the only sticking point here was really whether or not to add synth time validation, I think this is ready to go. If it is arguable that we really should have that validation, it isn't a breaking change to add it later.
Thank you for this!
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
|
@Mergifyio update |
❌ Mergify doesn't have permission to updateDetailsFor security reasons, Mergify can't update this pull request. Try updating locally. |
|
Get it together Mergify. |
Pull request has been modified.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
This makes it possible to enable DNSSEC signing for a Route 53 hosted zone. A new
KeySigningKeyconstruct is created to enable generally creating KSKs. Additionally, anenableDnssecmethod is added toHostedZonethat provides an easier interface. The later will create the KSK and further create the necessaryAWS::Route53::DNSSECresource to actually enable signing on the resource.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license