Route 53 DNS

Type: rvn-route53 · Latest version: 0.2.0

Readme

Manage Route 53 hosted zones, DNS records, query logging, and DNSSEC.

Overview

Use this module to create a Route 53 public or private hosted zone, manage DNS records in a created or existing zone, and optionally enable query logging or DNSSEC signing. A hosted zone is Route 53’s term for the DNS zone and name-server setup for a domain. If you are not familiar with the term, think of it as the place where Route 53 serves DNS records for your domain. The module supports standard records, alias records for AWS targets, and advanced Route 53 routing policies such as weighted, failover, latency, geolocation, and multivalue answer routing.

Use cases

Scenario	Benefit
Public domain hosting	Create a hosted zone and publish its name servers for registrar delegation.
Application DNS	Create A, AAAA, CNAME, TXT, MX, and alias records for apps and infrastructure.
Existing hosted zone	Manage records in a zone that already exists outside this module.
Private service discovery	Create a private hosted zone associated with one or more VPCs.
Advanced traffic routing	Use Route 53 routing policies for weighted, failover, latency, geolocation, or multivalue records.

Hosted zone mode

Enable Create hosted zone to create a new public or private hosted zone. In practical terms, this creates the Route 53-managed DNS zone that provides the name servers for your domain. Public zones return AWS name servers that you can delegate from your registrar or parent zone. Private zones require at least one VPC association. Disable Create hosted zone when the zone already exists and you only want this stack to manage records in it. In that mode, provide Hosted zone ID.

DNS records

DNS records are configured as structured entries. Terraform derives each resource key from the record name, type, and optional set identifier. Each record includes a record name, record type, and either standard record values with a TTL or an alias target. Standard records use TTL seconds and Record values. CNAME and SOA records use a single Record value because those record types accept exactly one value. Alias targets are exposed for A and AAAA records, which is the normal pattern for routing to AWS resources such as load balancers, CloudFront distributions, API Gateway domains, and S3 website endpoints. Alias records use Alias target DNS name and Alias target hosted zone ID. The alias target hosted zone ID belongs to the AWS target resource, not this domain’s hosted zone. For an ALB or NLB, use the load balancer canonical hosted zone ID. For CloudFront, use Z2FDTNDATAQYW2. Regional services such as API Gateway and S3 website endpoints have service and region-specific hosted zone IDs. Routing policy is optional. Use Set identifier for records that share the same name and type with weighted, failover, latency, or geolocation routing.

Query logging

Query logging streams Route 53 DNS query logs for public hosted zones to CloudWatch Logs. By default, the module creates the log group and resource policy in us-east-1, which is where Route 53 requires query logging destinations and permissions. Disable Create query log group only when you want to reuse an existing us-east-1 CloudWatch Logs log group. In that mode, provide Query log group ARN. The module still creates the resource policy that allows Route 53 to create log streams and write log events.

DNSSEC

DNSSEC signing is supported for public hosted zones and requires a customer-managed KMS key in us-east-1 with a key policy that allows Route 53 DNSSEC signing. After enabling DNSSEC, publish the DS record from the stack output in the parent zone or registrar.

Configuration

Setting	Required	Default	Notes
AWS account	Yes	None	AWS account where Route 53 resources are managed.
Region	Yes	None	Runner region for the stack. Route 53 hosted zones are global, but Terraform still runs with an AWS region.
Create hosted zone	No	true	Creates a new hosted zone instead of referencing an existing one.
Hosted zone ID	When Create hosted zone is disabled	None	Existing Route 53 hosted zone ID.
Domain name	When Create hosted zone is enabled	None	Domain name for the created hosted zone.
Comment	No	Managed by Terraform	Comment stored on the created hosted zone.
Force destroy records	No	false	Deletes all records when destroying a created hosted zone.
Delegation set ID	No	None	Reusable delegation set for created public zones.
Private hosted zone	No	false	Creates a private hosted zone instead of a public zone.
VPC associations	For private zones	Empty map	VPCs associated with the private hosted zone.
DNS records	No	Empty list	Structured Route 53 records to create in the hosted zone.
Query logging	No	false	Enables Route 53 query logging for public hosted zones.
Create query log group	No	true	Creates the CloudWatch Logs log group and resource policy in us-east-1.
Query log group name	No	Generated from hosted zone name	Name for the created CloudWatch Logs log group.
Query log retention days	No	90	Retention period for created query logs. Use 0 to retain indefinitely.
Query log resource policy name	No	Generated from hosted zone	Name for the CloudWatch Logs resource policy.
Query log group ARN	When Query logging is enabled and Create query log group is disabled	None	Existing us-east-1 CloudWatch Logs log group ARN for query logs.
DNSSEC signing	No	false	Enables DNSSEC signing.
DNSSEC KMS key ARN	When DNSSEC signing is enabled	None	Customer-managed KMS key ARN in us-east-1.
DNSSEC signing status	No	SIGNING	Signing status for the DNSSEC key signing key.
Tags	No	Standard Ravion tags	Additional tags merged with Ravion ownership and identity tags.
Terraform execution environment	No	None	Optional runner environment override.
Advanced Terraform variables	No	Empty object	Escape hatch for one-off Terraform variable overrides.

Design decisions

Hosted zone identity inputs are immutable because changing them can move records between zones or create a different zone. Operational settings such as records, query logging, DNSSEC status, and tags remain editable. Route 53 hosted zones are global resources. The Region input controls where the Terraform runner and AWS provider operate, and some features such as public-zone query logging and DNSSEC KMS keys still require us-east-1 resources. The module uses us-east-1 automatically for managed query log groups and resource policies. Ravion adds standard tags for ownership and traceability. User-provided Tags are merged on top for team, cost, or environment metadata.

Learn more

Inputs reference

All inputs for rvn-route53 version 0.2.0. Use the name shown for each field as the input key in module config.

AWS account & region

aws_account_id

string

required

AWS account.

Immutable after creation

aws_region

string

required

Region.

Immutable after creation

Hosted zone and name server

zone_creation_enabled

boolean

Create hosted zone. Create a new Route 53 hosted zone, which is Route 53’s DNS zone and name-server setup for a domain. Disable this to manage records in an existing hosted zone.

Default: true
Immutable after creation

zone_id

string

required

Hosted zone ID. Existing Route 53 hosted zone ID to manage records in. A hosted zone is Route 53’s DNS zone and name-server setup for a domain. Required when Create hosted zone is disabled.

Immutable after creation
Pattern: ^Z[0-9A-Z]+$ — Use a valid Route 53 hosted zone ID, for example Z1234567890ABC.
Shown when: {"zone_creation_enabled":false}

name

string

required

Domain name. Fully qualified domain name for the hosted zone.

Immutable after creation
Pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-._]*[a-zA-Z0-9])?$ — Use a valid domain name, for example example.com.
Shown when: {"zone_creation_enabled":true}

comment

string

Comment. Comment stored on the hosted zone.

Default: Managed in Ravion
Shown when: {"zone_creation_enabled":true}

record_force_destroy_enabled

boolean

Force destroy records. Destroy all records in the hosted zone when the created zone is destroyed.

Default: false
Shown when: {"zone_creation_enabled":true}

delegation_set_id

string

Delegation set ID. Reusable delegation set ID for a public hosted zone. Use this when you want multiple hosted zones to use the same authoritative name servers, for example to keep registrar or parent-zone delegation consistent across related domains.

Shown when: {"private_zone_enabled":false,"zone_creation_enabled":true}

private_zone_enabled

boolean

Private hosted zone. Create a private hosted zone associated with VPCs instead of a public hosted zone.

Default: false
Immutable after creation
Shown when: {"zone_creation_enabled":true}

vpc_associations

object_map

required

VPC associations. VPCs to associate with the private hosted zone.

Shown when: {"private_zone_enabled":true,"zone_creation_enabled":true}

Show item fields

vpc_id

string

required

VPC ID. VPC ID to associate with the private hosted zone.

Pattern: ^vpc- — Use a valid VPC ID starting with vpc-.

vpc_region

string

VPC region. AWS region for the VPC association. Defaults to the stack region when empty.

DNS records

records

object_array

Records. DNS records to create in the hosted zone.

Show item fields

type

string

required

Record type. DNS record type.

Allowed values: A, AAAA, CNAME, CAA, MX, NAPTR, NS, PTR, SOA, SPF, SRV, TXT, DS

name

string

required

Record name. Fully qualified record name.

target_type

string

required

Target type. Choose standard record values with a TTL, or an AWS alias target such as a load balancer or CloudFront distribution.

Default: standard
Allowed values: standard (Standard record values), alias (Alias target)
Shown when: {"type":["A","AAAA"]}

records

string_array

required

Record values. Values for a standard DNS record. Leave empty for alias records.

Shown when: {"target_type":{"not":"alias"},"type":{"not":["CNAME","SOA"]}}

record_value

string

required

Record value. Value for a standard DNS record type that accepts exactly one value.

Shown when: {"target_type":{"not":"alias"},"type":["CNAME","SOA"]}

alias_name

string

required

Alias target DNS name. DNS name of the AWS target resource. For an ALB or NLB, use the load balancer DNS name. For CloudFront, use the distribution domain name such as d111111abcdef8.cloudfront.net.

Shown when: {"target_type":"alias","type":["A","AAAA"]}

alias_zone_id

string

required

Alias target hosted zone ID. Hosted zone ID of the AWS target resource, not this domain’s hosted zone ID. For an ALB/NLB, use the load balancer canonical hosted zone ID from AWS. For CloudFront, use Z2FDTNDATAQYW2. Regional services such as API Gateway or S3 website endpoints have service and region-specific hosted zone IDs.

Shown when: {"target_type":"alias","type":["A","AAAA"]}

alias_evaluate_target_health

boolean

Evaluate target health. Let Route 53 consider the target resource health when answering DNS queries. This is commonly useful for load balancers. Leave disabled for targets that do not support Route 53 target health evaluation, such as CloudFront.

Default: false
Shown when: {"target_type":"alias","type":["A","AAAA"]}

health_check_id

string

Health check ID. Route 53 health check ID for this record.

allow_overwrite

boolean

Allow overwrite. Allow this record to overwrite an existing Route 53 record.

Default: false

ttl

number

TTL seconds. TTL in seconds for standard records. Lower values update faster but can increase DNS query volume; 300 seconds is a common default.

Default: 300
Min: 0
Shown when: {"target_type":{"not":"alias"}}

routing_policy

string

Routing policy. Optional Route 53 routing policy for this record.

Default: simple
Allowed values: simple (Simple), weighted (Weighted), failover (Failover), latency (Latency), geolocation (Geolocation), multivalue (Multivalue answer)

set_identifier

string

required

Set identifier. Unique identifier for a record that uses a routing policy. Required when multiple records share the same name and type.

Shown when: {"routing_policy":{"not":"simple"}}

weighted_routing_policy_weight

number

required

Weight. Weight for weighted routing.

Min: 0
Shown when: {"routing_policy":"weighted"}

failover_routing_policy_type

string

required

Failover type. Failover role for failover routing.

Allowed values: PRIMARY (Primary), SECONDARY (Secondary)
Shown when: {"routing_policy":"failover"}

latency_routing_policy_region

string

required

Latency region. AWS region for latency routing.

Shown when: {"routing_policy":"latency"}

geolocation_routing_policy_continent

string

Continent code. Continent code for geolocation routing.

Shown when: {"routing_policy":"geolocation"}

geolocation_routing_policy_country

string

Country code. Country code for geolocation routing.

Shown when: {"routing_policy":"geolocation"}

geolocation_routing_policy_subdivision

string

Subdivision code. Subdivision code for geolocation routing.

Shown when: {"routing_policy":"geolocation"}

Query logging

query_logging_enabled

boolean

Query logging. Enable Route 53 query logging for the public hosted zone.

Default: false
Shown when: {"private_zone_enabled":false}

query_log_group_creation_enabled

boolean

Create query log group. Create the CloudWatch Logs log group and resource policy in us-east-1 for Route 53 query logs.

Default: true
Shown when: {"private_zone_enabled":false,"query_logging_enabled":true}

query_log_group_name

string

Query log group name. Name for the created CloudWatch Logs log group. Defaults to /aws/route53/<hosted-zone-name>.

Shown when: {"private_zone_enabled":false,"query_log_group_creation_enabled":true,"query_logging_enabled":true}

query_log_group_retention_days

number

required

Query log retention days. Number of days to retain query logs. Use 0 to retain logs indefinitely.

Default: 90
Allowed values: 0 (Never expire), 1 (1 day), 3 (3 days), 5 (5 days), 7 (7 days), 14 (14 days), 30 (30 days), 60 (60 days), 90 (90 days), 180 (180 days), 365 (1 year), 731 (2 years), 1827 (5 years), 3653 (10 years)
Shown when: {"private_zone_enabled":false,"query_log_group_creation_enabled":true,"query_logging_enabled":true}

query_log_resource_policy_name

string

Query log resource policy name. Name for the CloudWatch Logs resource policy that allows Route 53 to write query logs. Defaults to a hosted-zone-derived name.

Shown when: {"private_zone_enabled":false,"query_logging_enabled":true}

query_log_group_arn

string

required

Query log group ARN. Existing CloudWatch Logs log group ARN for Route 53 query logs. The module will still create the required Route 53 resource policy.

Pattern: ^arn:aws:logs: — Use a valid CloudWatch Logs log group ARN.
Shown when: {"private_zone_enabled":false,"query_log_group_creation_enabled":false,"query_logging_enabled":true}

DNSSEC

dnssec_enabled

boolean

DNSSEC signing. Enable DNSSEC signing for the hosted zone.

Default: false
Shown when: {"private_zone_enabled":false}

dnssec_kms_key_arn

string

required

DNSSEC KMS key ARN. Customer-managed KMS key ARN in us-east-1 used for DNSSEC signing.

Pattern: ^arn:aws:kms:us-east-1: — Use a valid KMS key ARN in us-east-1.
Shown when: {"dnssec_enabled":true,"private_zone_enabled":false}

dnssec_signing_status

string

DNSSEC signing status. DNSSEC key signing status.

Default: SIGNING
Allowed values: SIGNING (Signing), NOT_SIGNING (Not signing)
Shown when: {"dnssec_enabled":true,"private_zone_enabled":false}

Misc

Terraform settings

opentofu_version

string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

advanced_terraform_variables

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

execution_environment_id

string

Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.

Introduction

Use cases

Concepts

Config as code

Migrate

Modules

Pipelines

Guides

Module definitions

Readme

Overview

Use cases

Hosted zone mode

DNS records

Query logging

DNSSEC

Configuration

Design decisions

Learn more

Inputs reference

AWS account & region

Hosted zone and name server

DNS records

Query logging

DNSSEC

Misc

Terraform settings

​Readme

​Overview

​Use cases

​Hosted zone mode

​DNS records

​Query logging

​DNSSEC

​Configuration

​Design decisions

​Learn more

​Inputs reference

​AWS account & region

​Hosted zone and name server

​DNS records

​Query logging

​DNSSEC

​Misc

​Terraform settings

Readme

Overview

Use cases

Hosted zone mode

DNS records

Query logging

DNSSEC

Configuration

Design decisions

Learn more

Inputs reference

AWS account & region

Hosted zone and name server

DNS records

Query logging

DNSSEC

Misc

Terraform settings