> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Route 53 DNS > Manage Route 53 hosted zones, DNS records, query logging, and DNSSEC. **Type:** `rvn-route53` · **Latest version:** `0.2.0` ## Readme Manage Route 53 hosted zones, DNS records, query logging, and DNSSEC. ### Overview Use this module to create a Route 53 public or private hosted zone, manage DNS records in a created or existing zone, and optionally enable query logging or DNSSEC signing. A hosted zone is Route 53's term for the DNS zone and name-server setup for a domain. If you are not familiar with the term, think of it as the place where Route 53 serves DNS records for your domain. The module supports standard records, alias records for AWS targets, and advanced Route 53 routing policies such as weighted, failover, latency, geolocation, and multivalue answer routing. ### Use cases | Scenario | Benefit | | ------------------------- | -------------------------------------------------------------------------------------------------- | | Public domain hosting | Create a hosted zone and publish its name servers for registrar delegation. | | Application DNS | Create A, AAAA, CNAME, TXT, MX, and alias records for apps and infrastructure. | | Existing hosted zone | Manage records in a zone that already exists outside this module. | | Private service discovery | Create a private hosted zone associated with one or more VPCs. | | Advanced traffic routing | Use Route 53 routing policies for weighted, failover, latency, geolocation, or multivalue records. | ### Hosted zone mode Enable Create hosted zone to create a new public or private hosted zone. In practical terms, this creates the Route 53-managed DNS zone that provides the name servers for your domain. Public zones return AWS name servers that you can delegate from your registrar or parent zone. Private zones require at least one VPC association. Disable Create hosted zone when the zone already exists and you only want this stack to manage records in it. In that mode, provide Hosted zone ID. ### DNS records DNS records are configured as structured entries. Terraform derives each resource key from the record name, type, and optional set identifier. Each record includes a record name, record type, and either standard record values with a TTL or an alias target. Standard records use TTL seconds and Record values. CNAME and SOA records use a single Record value because those record types accept exactly one value. Alias targets are exposed for A and AAAA records, which is the normal pattern for routing to AWS resources such as load balancers, CloudFront distributions, API Gateway domains, and S3 website endpoints. Alias records use Alias target DNS name and Alias target hosted zone ID. The alias target hosted zone ID belongs to the AWS target resource, not this domain's hosted zone. For an ALB or NLB, use the load balancer canonical hosted zone ID. For CloudFront, use Z2FDTNDATAQYW2. Regional services such as API Gateway and S3 website endpoints have service and region-specific hosted zone IDs. Routing policy is optional. Use Set identifier for records that share the same name and type with weighted, failover, latency, or geolocation routing. ### Query logging Query logging streams Route 53 DNS query logs for public hosted zones to CloudWatch Logs. By default, the module creates the log group and resource policy in us-east-1, which is where Route 53 requires query logging destinations and permissions. Disable Create query log group only when you want to reuse an existing us-east-1 CloudWatch Logs log group. In that mode, provide Query log group ARN. The module still creates the resource policy that allows Route 53 to create log streams and write log events. ### DNSSEC DNSSEC signing is supported for public hosted zones and requires a customer-managed KMS key in us-east-1 with a key policy that allows Route 53 DNSSEC signing. After enabling DNSSEC, publish the DS record from the stack output in the parent zone or registrar. ### Configuration | Setting | Required | Default | Notes | | ------------------------------- | -------------------------------------------------------------------- | ------------------------------- | ----------------------------------------------------------------------------------------------------------- | | AWS account | Yes | None | AWS account where Route 53 resources are managed. | | Region | Yes | None | Runner region for the stack. Route 53 hosted zones are global, but Terraform still runs with an AWS region. | | Create hosted zone | No | true | Creates a new hosted zone instead of referencing an existing one. | | Hosted zone ID | When Create hosted zone is disabled | None | Existing Route 53 hosted zone ID. | | Domain name | When Create hosted zone is enabled | None | Domain name for the created hosted zone. | | Comment | No | Managed by Terraform | Comment stored on the created hosted zone. | | Force destroy records | No | false | Deletes all records when destroying a created hosted zone. | | Delegation set ID | No | None | Reusable delegation set for created public zones. | | Private hosted zone | No | false | Creates a private hosted zone instead of a public zone. | | VPC associations | For private zones | Empty map | VPCs associated with the private hosted zone. | | DNS records | No | Empty list | Structured Route 53 records to create in the hosted zone. | | Query logging | No | false | Enables Route 53 query logging for public hosted zones. | | Create query log group | No | true | Creates the CloudWatch Logs log group and resource policy in us-east-1. | | Query log group name | No | Generated from hosted zone name | Name for the created CloudWatch Logs log group. | | Query log retention days | No | 90 | Retention period for created query logs. Use 0 to retain indefinitely. | | Query log resource policy name | No | Generated from hosted zone | Name for the CloudWatch Logs resource policy. | | Query log group ARN | When Query logging is enabled and Create query log group is disabled | None | Existing us-east-1 CloudWatch Logs log group ARN for query logs. | | DNSSEC signing | No | false | Enables DNSSEC signing. | | DNSSEC KMS key ARN | When DNSSEC signing is enabled | None | Customer-managed KMS key ARN in us-east-1. | | DNSSEC signing status | No | SIGNING | Signing status for the DNSSEC key signing key. | | Tags | No | Standard Ravion tags | Additional tags merged with Ravion ownership and identity tags. | | Terraform execution environment | No | None | Optional runner environment override. | | Advanced Terraform variables | No | Empty object | Escape hatch for one-off Terraform variable overrides. | ### Design decisions Hosted zone identity inputs are immutable because changing them can move records between zones or create a different zone. Operational settings such as records, query logging, DNSSEC status, and tags remain editable. Route 53 hosted zones are global resources. The Region input controls where the Terraform runner and AWS provider operate, and some features such as public-zone query logging and DNSSEC KMS keys still require us-east-1 resources. The module uses us-east-1 automatically for managed query log groups and resource policies. Ravion adds standard tags for ownership and traceability. User-provided Tags are merged on top for team, cost, or environment metadata. ### Learn more * [Route 53 hosted zones](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-working-with.html) * [Route 53 resource record sets](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/rrsets-working-with.html) * [Route 53 DNSSEC signing](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html) * [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-route53@0.2.0/networking/route53) ## Inputs reference All inputs for `rvn-route53` version `0.2.0`. Use the `name` shown for each field as the input key in module config. ### AWS account & region **AWS account.** * Immutable after creation **Region.** * Immutable after creation ### Hosted zone and name server **Create hosted zone.** Create a new Route 53 hosted zone, which is Route 53's DNS zone and name-server setup for a domain. Disable this to manage records in an existing hosted zone. * Default: `true` * Immutable after creation **Hosted zone ID.** Existing Route 53 hosted zone ID to manage records in. A hosted zone is Route 53's DNS zone and name-server setup for a domain. Required when Create hosted zone is disabled. * Immutable after creation * Pattern: `^Z[0-9A-Z]+$` — Use a valid Route 53 hosted zone ID, for example Z1234567890ABC. * Shown when: `{"zone_creation_enabled":false}` **Domain name.** Fully qualified domain name for the hosted zone. * Immutable after creation * Pattern: `^[a-zA-Z0-9]([a-zA-Z0-9-._]*[a-zA-Z0-9])?$` — Use a valid domain name, for example example.com. * Shown when: `{"zone_creation_enabled":true}` **Comment.** Comment stored on the hosted zone. * Default: `Managed in Ravion` * Shown when: `{"zone_creation_enabled":true}` **Force destroy records.** Destroy all records in the hosted zone when the created zone is destroyed. * Default: `false` * Shown when: `{"zone_creation_enabled":true}` **Delegation set ID.** Reusable delegation set ID for a public hosted zone. Use this when you want multiple hosted zones to use the same authoritative name servers, for example to keep registrar or parent-zone delegation consistent across related domains. * Shown when: `{"private_zone_enabled":false,"zone_creation_enabled":true}` **Private hosted zone.** Create a private hosted zone associated with VPCs instead of a public hosted zone. * Default: `false` * Immutable after creation * Shown when: `{"zone_creation_enabled":true}` **VPC associations.** VPCs to associate with the private hosted zone. * Shown when: `{"private_zone_enabled":true,"zone_creation_enabled":true}` **VPC ID.** VPC ID to associate with the private hosted zone. * Pattern: `^vpc-` — Use a valid VPC ID starting with vpc-. **VPC region.** AWS region for the VPC association. Defaults to the stack region when empty. ### DNS records **Records.** DNS records to create in the hosted zone. **Record type.** DNS record type. * Allowed values: `A`, `AAAA`, `CNAME`, `CAA`, `MX`, `NAPTR`, `NS`, `PTR`, `SOA`, `SPF`, `SRV`, `TXT`, `DS` **Record name.** Fully qualified record name. **Target type.** Choose standard record values with a TTL, or an AWS alias target such as a load balancer or CloudFront distribution. * Default: `standard` * Allowed values: `standard` (Standard record values), `alias` (Alias target) * Shown when: `{"type":["A","AAAA"]}` **Record values.** Values for a standard DNS record. Leave empty for alias records. * Shown when: `{"target_type":{"not":"alias"},"type":{"not":["CNAME","SOA"]}}` **Record value.** Value for a standard DNS record type that accepts exactly one value. * Shown when: `{"target_type":{"not":"alias"},"type":["CNAME","SOA"]}` **Alias target DNS name.** DNS name of the AWS target resource. For an ALB or NLB, use the load balancer DNS name. For CloudFront, use the distribution domain name such as d111111abcdef8.cloudfront.net. * Shown when: `{"target_type":"alias","type":["A","AAAA"]}` **Alias target hosted zone ID.** Hosted zone ID of the AWS target resource, not this domain's hosted zone ID. For an ALB/NLB, use the load balancer canonical hosted zone ID from AWS. For CloudFront, use Z2FDTNDATAQYW2. Regional services such as API Gateway or S3 website endpoints have service and region-specific hosted zone IDs. * Shown when: `{"target_type":"alias","type":["A","AAAA"]}` **Evaluate target health.** Let Route 53 consider the target resource health when answering DNS queries. This is commonly useful for load balancers. Leave disabled for targets that do not support Route 53 target health evaluation, such as CloudFront. * Default: `false` * Shown when: `{"target_type":"alias","type":["A","AAAA"]}` **Health check ID.** Route 53 health check ID for this record. **Allow overwrite.** Allow this record to overwrite an existing Route 53 record. * Default: `false` **TTL seconds.** TTL in seconds for standard records. Lower values update faster but can increase DNS query volume; 300 seconds is a common default. * Default: `300` * Min: `0` * Shown when: `{"target_type":{"not":"alias"}}` **Routing policy.** Optional Route 53 routing policy for this record. * Default: `simple` * Allowed values: `simple` (Simple), `weighted` (Weighted), `failover` (Failover), `latency` (Latency), `geolocation` (Geolocation), `multivalue` (Multivalue answer) **Set identifier.** Unique identifier for a record that uses a routing policy. Required when multiple records share the same name and type. * Shown when: `{"routing_policy":{"not":"simple"}}` **Weight.** Weight for weighted routing. * Min: `0` * Shown when: `{"routing_policy":"weighted"}` **Failover type.** Failover role for failover routing. * Allowed values: `PRIMARY` (Primary), `SECONDARY` (Secondary) * Shown when: `{"routing_policy":"failover"}` **Latency region.** AWS region for latency routing. * Shown when: `{"routing_policy":"latency"}` **Continent code.** Continent code for geolocation routing. * Shown when: `{"routing_policy":"geolocation"}` **Country code.** Country code for geolocation routing. * Shown when: `{"routing_policy":"geolocation"}` **Subdivision code.** Subdivision code for geolocation routing. * Shown when: `{"routing_policy":"geolocation"}` ### Query logging **Query logging.** Enable Route 53 query logging for the public hosted zone. * Default: `false` * Shown when: `{"private_zone_enabled":false}` **Create query log group.** Create the CloudWatch Logs log group and resource policy in us-east-1 for Route 53 query logs. * Default: `true` * Shown when: `{"private_zone_enabled":false,"query_logging_enabled":true}` **Query log group name.** Name for the created CloudWatch Logs log group. Defaults to /aws/route53/\. * Shown when: `{"private_zone_enabled":false,"query_log_group_creation_enabled":true,"query_logging_enabled":true}` **Query log retention days.** Number of days to retain query logs. Use 0 to retain logs indefinitely. * Default: `90` * Allowed values: `0` (Never expire), `1` (1 day), `3` (3 days), `5` (5 days), `7` (7 days), `14` (14 days), `30` (30 days), `60` (60 days), `90` (90 days), `180` (180 days), `365` (1 year), `731` (2 years), `1827` (5 years), `3653` (10 years) * Shown when: `{"private_zone_enabled":false,"query_log_group_creation_enabled":true,"query_logging_enabled":true}` **Query log resource policy name.** Name for the CloudWatch Logs resource policy that allows Route 53 to write query logs. Defaults to a hosted-zone-derived name. * Shown when: `{"private_zone_enabled":false,"query_logging_enabled":true}` **Query log group ARN.** Existing CloudWatch Logs log group ARN for Route 53 query logs. The module will still create the required Route 53 resource policy. * Pattern: `^arn:aws:logs:` — Use a valid CloudWatch Logs log group ARN. * Shown when: `{"private_zone_enabled":false,"query_log_group_creation_enabled":false,"query_logging_enabled":true}` ### DNSSEC **DNSSEC signing.** Enable DNSSEC signing for the hosted zone. * Default: `false` * Shown when: `{"private_zone_enabled":false}` **DNSSEC KMS key ARN.** Customer-managed KMS key ARN in us-east-1 used for DNSSEC signing. * Pattern: `^arn:aws:kms:us-east-1:` — Use a valid KMS key ARN in us-east-1. * Shown when: `{"dnssec_enabled":true,"private_zone_enabled":false}` **DNSSEC signing status.** DNSSEC key signing status. * Default: `SIGNING` * Allowed values: `SIGNING` (Signing), `NOT_SIGNING` (Not signing) * Shown when: `{"dnssec_enabled":true,"private_zone_enabled":false}` ### Misc **Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId` ### Terraform settings **OpenTofu version override.** Override the environment's default version for this module **Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids. * Immutable after creation **Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above. * Default: `{}` **Terraform execution environment.** Override the execution environment for Terraform runners. Must use the same AWS account as selected above.