feat(route53): DNSSEC zone signing
#28604
Conversation
github-actions
bot
added
p2
star-contributor
aws-cdk-automation
added
the
pr/needs-community-review
kylelaker
changed the title
kaizencc
changed the title
|
|
||
| constructor(scope: Construct, id: string, props: KeySigningKeyProps) { | ||
| super(scope, id, { | ||
| physicalName: props.keySigningKeyName ?? Lazy.string({ |
There was a problem hiding this comment.
We should add validation for keySigningKeyName according to the docs.
There was a problem hiding this comment.
I don't actually love doing this because if the service team changes this, we have to make an additional code change to allow customers to use the new pattern as well. I tend to think that the deploy time validation should be good enough in this case.
Another option I've been considering is trying to add something into our overall validation at synth that takes in any of these patterns and checks against it, but that's much much larger project than this.
| }); | ||
| // The KSK must exist and be in an 'ACTIVE' status before DNSSEC can be enabled. | ||
| dnssec.addDependency(this.keySigningKey.node.defaultChild as CfnKeySigningKey); | ||
| return this.keySigningKey; |
There was a problem hiding this comment.
Do we need to return the key? 🤔
|
@kylelaker This one looks really close. Want to address @lpizzinidev comments? I can help get it over the finish line if you're swamped. |
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
aws-cdk-automation
removed
the
pr/needs-community-review
TheRealAmazonKendra
changed the title
DNSSEC zone signing
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
|
@Mergifyio update |
❌ Mergify doesn't have permission to updateFor security reasons, Mergify can't update this pull request. Try updating locally. |
|
Get it together Mergify. |
mergify
bot
dismissed
TheRealAmazonKendra’s stale review
Pull request has been modified.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
This makes it possible to enable DNSSEC signing for a Route 53 hosted zone. A new
KeySigningKeyconstruct is created to enable generally creating KSKs. Additionally, anenableDnssecmethod is added toHostedZonethat provides an easier interface. The later will create the KSK and further create the necessaryAWS::Route53::DNSSECresource to actually enable signing on the resource.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license