Bring the Route 53 hosted zones under Terraform - #189
Merged
Conversation
Contributor
|
Terraform plan in terraform Plan: 32 to import, 0 to add, 11 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.access-the-data.aws_route53_record.apex will be imported
resource "aws_route53_record" "apex" {
fqdn = "accessthedata.org"
health_check_id = null
id = "Z099349812ZUUFQEPL51Q_accessthedata.org_A"
multivalue_answer_routing_policy = false
name = "accessthedata.org"
records = [
"185.199.108.153",
"185.199.109.153",
"185.199.110.153",
"185.199.111.153",
]
set_identifier = null
ttl = 3600
type = "A"
zone_id = "*********************"
}
# module.access-the-data.aws_route53_record.apex_ipv6 will be imported
resource "aws_route53_record" "apex_ipv6" {
fqdn = "accessthedata.org"
health_check_id = null
id = "Z099349812ZUUFQEPL51Q_accessthedata.org_AAAA"
multivalue_answer_routing_policy = false
name = "accessthedata.org"
records = [
"2606:50c0:8000::153",
"2606:50c0:8001::153",
"2606:50c0:8002::153",
"2606:50c0:8003::153",
]
set_identifier = null
ttl = 3600
type = "AAAA"
zone_id = "*********************"
}
# module.access-the-data.aws_route53_record.cert_validation will be imported
resource "aws_route53_record" "cert_validation" {
fqdn = "_0cf1f0f2546b74cb244e41df3c73afe6.accessthedata.org"
health_check_id = null
id = "Z099349812ZUUFQEPL51Q__0cf1f0f2546b74cb244e41df3c73afe6.accessthedata.org_CNAME"
multivalue_answer_routing_policy = false
name = "_0cf1f0f2546b74cb244e41df3c73afe6.accessthedata.org"
records = [
"_f6e79d0bd5ddcd952dae00479b8d4a1c.cmqshkkvmc.acm-validations.aws.",
]
set_identifier = null
ttl = 60
type = "CNAME"
zone_id = "*********************"
}
# module.access-the-data.aws_route53_zone.this will be updated in-place
# (imported from "Z099349812ZUUFQEPL51Q")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z099349812ZUUFQEPL51Q"
comment = "Managed by Terraform"
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z099349812ZUUFQEPL51Q"
name = "accessthedata.org"
name_servers = [
"ns-1125.awsdns-12.org",
"ns-1680.awsdns-18.co.uk",
"ns-234.awsdns-29.com",
"ns-876.awsdns-45.net",
]
primary_name_server = "ns-234.awsdns-29.com"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "*********************"
}
# module.ballotnav.aws_route53_record.apex will be imported
resource "aws_route53_record" "apex" {
fqdn = "ballotnav.org"
health_check_id = null
id = "Z07523651NOVLWMBAS3IL_ballotnav.org_A"
multivalue_answer_routing_policy = false
name = "ballotnav.org"
records = [
"185.199.108.153",
"185.199.109.153",
"185.199.110.153",
"185.199.111.153",
]
set_identifier = null
ttl = 300
type = "A"
zone_id = "*********************"
}
# module.ballotnav.aws_route53_record.pages["about"] will be imported
resource "aws_route53_record" "pages" {
fqdn = "about.ballotnav.org"
health_check_id = null
id = "Z07523651NOVLWMBAS3IL_about.ballotnav.org_CNAME"
multivalue_answer_routing_policy = false
name = "about.ballotnav.org"
records = [
"hackforla.github.io",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.ballotnav.aws_route53_record.pages["admin"] will be imported
resource "aws_route53_record" "pages" {
fqdn = "admin.ballotnav.org"
health_check_id = null
id = "Z07523651NOVLWMBAS3IL_admin.ballotnav.org_CNAME"
multivalue_answer_routing_policy = false
name = "admin.ballotnav.org"
records = [
"hackforla.github.io",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.ballotnav.aws_route53_record.pages["demo"] will be imported
resource "aws_route53_record" "pages" {
fqdn = "demo.ballotnav.org"
health_check_id = null
id = "Z07523651NOVLWMBAS3IL_demo.ballotnav.org_CNAME"
multivalue_answer_routing_policy = false
name = "demo.ballotnav.org"
records = [
"hackforla.github.io",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.ballotnav.aws_route53_record.pages["www"] will be imported
resource "aws_route53_record" "pages" {
fqdn = "www.ballotnav.org"
health_check_id = null
id = "Z07523651NOVLWMBAS3IL_www.ballotnav.org_CNAME"
multivalue_answer_routing_policy = false
name = "www.ballotnav.org"
records = [
"hackforla.github.io",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.ballotnav.aws_route53_zone.this will be updated in-place
# (imported from "Z07523651NOVLWMBAS3IL")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z07523651NOVLWMBAS3IL"
comment = null
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z07523651NOVLWMBAS3IL"
name = "ballotnav.org"
name_servers = [
"ns-1521.awsdns-62.org",
"ns-1627.awsdns-11.co.uk",
"ns-599.awsdns-10.net",
"ns-62.awsdns-07.com",
]
primary_name_server = "ns-1521.awsdns-62.org"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "*********************"
}
# module.civic-tech-index.aws_route53_record.apex will be imported
resource "aws_route53_record" "apex" {
fqdn = "civictechindex.org"
health_check_id = null
id = "Z06388811ED8NRSEUZU7A_civictechindex.org_A"
multivalue_answer_routing_policy = false
name = "civictechindex.org"
records = []
set_identifier = null
ttl = 0
type = "A"
zone_id = "*********************"
alias {
evaluate_target_health = false
name = "s3-website-us-west-2.amazonaws.com"
zone_id = "**************"
}
}
# module.civic-tech-index.aws_route53_record.api will be imported
resource "aws_route53_record" "api" {
fqdn = "api.civictechindex.org"
health_check_id = null
id = "Z06388811ED8NRSEUZU7A_api.civictechindex.org_CNAME"
multivalue_answer_routing_policy = false
name = "api.civictechindex.org"
records = [
"incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.civic-tech-index.aws_route53_record.api_stage will be imported
resource "aws_route53_record" "api_stage" {
fqdn = "api-stage.civictechindex.org"
health_check_id = null
id = "Z06388811ED8NRSEUZU7A_api-stage.civictechindex.org_CNAME"
multivalue_answer_routing_policy = false
name = "api-stage.civictechindex.org"
records = [
"incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.civic-tech-index.aws_route53_record.cert_validation will be imported
resource "aws_route53_record" "cert_validation" {
fqdn = "_9aed66007870880679080f7176758008.civictechindex.org"
health_check_id = null
id = "Z06388811ED8NRSEUZU7A__9aed66007870880679080f7176758008.civictechindex.org_CNAME"
multivalue_answer_routing_policy = false
name = "_9aed66007870880679080f7176758008.civictechindex.org"
records = [
"_5f8c553c390792dc338365781f5ccc8e.zzxlnyslwt.acm-validations.aws.",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.civic-tech-index.aws_route53_zone.this will be updated in-place
# (imported from "Z06388811ED8NRSEUZU7A")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z06388811ED8NRSEUZU7A"
comment = null
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z06388811ED8NRSEUZU7A"
name = "civictechindex.org"
name_servers = [
"ns-1159.awsdns-16.org",
"ns-1990.awsdns-56.co.uk",
"ns-412.awsdns-51.com",
"ns-972.awsdns-57.net",
]
primary_name_server = "ns-1990.awsdns-56.co.uk"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "*********************"
}
# module.civic-tech-jobs.aws_route53_record.apex will be imported
resource "aws_route53_record" "apex" {
fqdn = "civictechjobs.org"
health_check_id = null
id = "Z06949943QJY32WRKG577_civictechjobs.org_A"
multivalue_answer_routing_policy = false
name = "civictechjobs.org"
records = [
"185.199.108.153",
"185.199.109.153",
"185.199.110.153",
"185.199.111.153",
]
set_identifier = null
ttl = 300
type = "A"
zone_id = "*********************"
}
# module.civic-tech-jobs.aws_route53_record.cert_validation_apex will be imported
resource "aws_route53_record" "cert_validation_apex" {
fqdn = "_a57d306f01d9b44fbca0d00a608ea608.civictechjobs.org"
health_check_id = null
id = "Z06949943QJY32WRKG577__a57d306f01d9b44fbca0d00a608ea608.civictechjobs.org_CNAME"
multivalue_answer_routing_policy = false
name = "_a57d306f01d9b44fbca0d00a608ea608.civictechjobs.org"
records = [
"_bfd3a50aa6f2f2dec50d28873885838d.tctzzymbbs.acm-validations.aws.",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.civic-tech-jobs.aws_route53_record.cert_validation_stage will be imported
resource "aws_route53_record" "cert_validation_stage" {
fqdn = "_1ca49dd660678abe9478619c13875864.stage.civictechjobs.org"
health_check_id = null
id = "Z06949943QJY32WRKG577__1ca49dd660678abe9478619c13875864.stage.civictechjobs.org_CNAME"
multivalue_answer_routing_policy = false
name = "_1ca49dd660678abe9478619c13875864.stage.civictechjobs.org"
records = [
"_aaf9335595c8bd7c846a550221d3b3e4.tctzzymbbs.acm-validations.aws",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.civic-tech-jobs.aws_route53_record.www will be imported
resource "aws_route53_record" "www" {
fqdn = "www.civictechjobs.org"
health_check_id = null
id = "Z06949943QJY32WRKG577_www.civictechjobs.org_CNAME"
multivalue_answer_routing_policy = false
name = "www.civictechjobs.org"
records = [
"hackforla.github.io",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.civic-tech-jobs.aws_route53_zone.this will be updated in-place
# (imported from "Z06949943QJY32WRKG577")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z06949943QJY32WRKG577"
comment = null
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z06949943QJY32WRKG577"
name = "civictechjobs.org"
name_servers = [
"ns-1465.awsdns-55.org",
"ns-1796.awsdns-32.co.uk",
"ns-422.awsdns-52.com",
"ns-970.awsdns-57.net",
]
primary_name_server = "ns-422.awsdns-52.com"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "*********************"
}
# module.home-unite-us.aws_route53_record.apex will be updated in-place
# (imported from "Z03829196Z0VAL9Q8CZ_homeunite.us_A")
!~ resource "aws_route53_record" "apex" {
fqdn = "homeunite.us"
health_check_id = null
id = "Z03829196Z0VAL9Q8CZ_homeunite.us_A"
multivalue_answer_routing_policy = false
name = "homeunite.us"
!~ records = [
- "18.223.160.58",
]
set_identifier = null
- ttl = 300 -> null
type = "A"
zone_id = "*******************"
+ alias {
+ evaluate_target_health = false
+ name = "incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com"
+ zone_id = "*************"
}
}
# module.home-unite-us.aws_route53_record.cert_validation will be imported
resource "aws_route53_record" "cert_validation" {
fqdn = "_5bb55cc568d53bab04232d9f9e534189.homeunite.us"
health_check_id = null
id = "Z03829196Z0VAL9Q8CZ__5bb55cc568d53bab04232d9f9e534189.homeunite.us_CNAME"
multivalue_answer_routing_policy = false
name = "_5bb55cc568d53bab04232d9f9e534189.homeunite.us"
records = [
"_b364adf29acc28331d5a45a7c9a40fad.fsdcfjjflr.acm-validations.aws.",
]
set_identifier = null
ttl = 60
type = "CNAME"
zone_id = "*******************"
}
# module.home-unite-us.aws_route53_record.qa will be imported
resource "aws_route53_record" "qa" {
fqdn = "qa.homeunite.us"
health_check_id = null
id = "Z03829196Z0VAL9Q8CZ_qa.homeunite.us_CNAME"
multivalue_answer_routing_policy = false
name = "qa.homeunite.us"
records = [
"incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*******************"
}
# module.home-unite-us.aws_route53_record.www will be imported
resource "aws_route53_record" "www" {
fqdn = "www.homeunite.us"
health_check_id = null
id = "Z03829196Z0VAL9Q8CZ_www.homeunite.us_CNAME"
multivalue_answer_routing_policy = false
name = "www.homeunite.us"
records = [
"incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*******************"
}
# module.home-unite-us.aws_route53_zone.this will be updated in-place
# (imported from "Z03829196Z0VAL9Q8CZ")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z03829196Z0VAL9Q8CZ"
comment = "Managed by Terraform"
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z03829196Z0VAL9Q8CZ"
name = "homeunite.us"
name_servers = [
"ns-1209.awsdns-23.org",
"ns-1686.awsdns-18.co.uk",
"ns-212.awsdns-26.com",
"ns-820.awsdns-38.net",
]
primary_name_server = "ns-1686.awsdns-18.co.uk"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "*******************"
}
# module.three-eleven-data.aws_route53_record.apex will be imported
resource "aws_route53_record" "apex" {
fqdn = "311-data.org"
health_check_id = null
id = "Z10404141P7IPBA313E5M_311-data.org_A"
multivalue_answer_routing_policy = false
name = "311-data.org"
records = [
"185.199.108.153",
"185.199.109.153",
"185.199.110.153",
"185.199.111.153",
]
set_identifier = null
ttl = 300
type = "A"
zone_id = "*********************"
}
# module.three-eleven-data.aws_route53_record.www will be updated in-place
# (imported from "Z10404141P7IPBA313E5M_www.311-data.org_CNAME")
!~ resource "aws_route53_record" "www" {
fqdn = "www.311-data.org"
health_check_id = null
id = "Z10404141P7IPBA313E5M_www.311-data.org_CNAME"
multivalue_answer_routing_policy = false
name = "www.311-data.org"
!~ records = [
- "311-data.org",
+ "hackforla.github.io",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "*********************"
}
# module.three-eleven-data.aws_route53_zone.this will be updated in-place
# (imported from "Z10404141P7IPBA313E5M")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z10404141P7IPBA313E5M"
comment = null
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z10404141P7IPBA313E5M"
name = "311-data.org"
name_servers = [
"ns-1157.awsdns-16.org",
"ns-1549.awsdns-01.co.uk",
"ns-473.awsdns-59.com",
"ns-982.awsdns-58.net",
]
primary_name_server = "ns-1549.awsdns-01.co.uk"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "*********************"
}
# module.vrms.aws_route53_record.apex will be imported
resource "aws_route53_record" "apex" {
fqdn = "vrms.io"
health_check_id = null
id = "Z0420800PGQ9JP6DM9EX_vrms.io_A"
multivalue_answer_routing_policy = false
name = "vrms.io"
records = []
set_identifier = null
ttl = 0
type = "A"
zone_id = "********************"
alias {
evaluate_target_health = false
name = "incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com"
zone_id = "*************"
}
}
# module.vrms.aws_route53_record.cert_validation will be imported
resource "aws_route53_record" "cert_validation" {
fqdn = "_ae6574e1afa9e171d1634c7d7df55699.vrms.io"
health_check_id = null
id = "Z0420800PGQ9JP6DM9EX__ae6574e1afa9e171d1634c7d7df55699.vrms.io_CNAME"
multivalue_answer_routing_policy = false
name = "_ae6574e1afa9e171d1634c7d7df55699.vrms.io"
records = [
"_75a716975d76b9c6a4e2d61c0b489e29.bwlshdtstt.acm-validations.aws.",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "********************"
}
# module.vrms.aws_route53_record.www will be imported
resource "aws_route53_record" "www" {
fqdn = "www.vrms.io"
health_check_id = null
id = "Z0420800PGQ9JP6DM9EX_www.vrms.io_CNAME"
multivalue_answer_routing_policy = false
name = "www.vrms.io"
records = [
"incubator-prod-lb-569274394.us-west-2.elb.amazonaws.com",
]
set_identifier = null
ttl = 300
type = "CNAME"
zone_id = "********************"
}
# module.vrms.aws_route53_zone.this will be updated in-place
# (imported from "Z0420800PGQ9JP6DM9EX")
!~ resource "aws_route53_zone" "this" {
arn = "arn:aws:route53:::hostedzone/Z0420800PGQ9JP6DM9EX"
comment = null
delegation_set_id = null
enable_accelerated_recovery = false
+ force_destroy = false
id = "Z0420800PGQ9JP6DM9EX"
name = "vrms.io"
name_servers = [
"ns-1177.awsdns-19.org",
"ns-185.awsdns-23.com",
"ns-1937.awsdns-50.co.uk",
"ns-620.awsdns-13.net",
]
primary_name_server = "ns-1937.awsdns-50.co.uk"
tags = {}
!~ tags_all = {
+ "managed-by" = "terraform-incubator"
}
zone_id = "********************"
}
# module.civic-tech-index.module.backend_stage_service.aws_lb_listener_rule.static will be updated in-place
!~ resource "aws_lb_listener_rule" "static" {
id = "arn:aws:elasticloadbalancing:us-west-2:035866691871:listener-rule/app/incubator-prod-lb/7451adf77133ef36/390a225766a4daf3/6c6bd28e830d0f4a"
tags = {}
# (5 unchanged attributes hidden)
- condition {
- host_header {
- regex_values = [] -> null
- values = [
- "api-stage.civictechindex.org",
- "stage.api.civictechindex.org",
] -> null
}
}
+ condition {
+ host_header {
+ regex_values = []
+ values = [
+ "api-stage.civictechindex.org",
]
}
}
# (2 unchanged blocks hidden)
}
# module.home-unite-us.module.prod_service.aws_lb_listener_rule.static will be updated in-place
!~ resource "aws_lb_listener_rule" "static" {
id = "arn:aws:elasticloadbalancing:us-west-2:035866691871:listener-rule/app/incubator-prod-lb/7451adf77133ef36/390a225766a4daf3/20413b899ccb8d07"
tags = {}
# (5 unchanged attributes hidden)
- condition {
- host_header {
- regex_values = [] -> null
- values = [
- "qa.homeunite.us",
- "www.homeunite.us",
] -> null
}
}
+ condition {
+ host_header {
+ regex_values = []
+ values = [
+ "homeunite.us",
+ "qa.homeunite.us",
+ "www.homeunite.us",
]
}
}
# (2 unchanged blocks hidden)
}
Plan: 32 to import, 0 to add, 11 to change, 0 to destroy.✅ Plan applied in Terraform apply (OIDC) #71 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #183.
Brings all seven Route 53 hosted zones in
035866691871under Terraform, plus every record in them that was not already managed. Each zone is declared in its own project module'sdns.tf, so the zone sits next to the things that use it.Two project modules are new —
projects/ballotnavandprojects/311-data— andprojects/access-the-data, which was an empty directory, is now populated and wired intomain.tf. All three are DNS only; those projects have no compute in this account. Notemodule "311-data"is not a legal Terraform identifier, so the module isthree-eleven-datawhile the directory keeps the project's name.What the plan should look like
Not a zero-change plan. The bar is 0 to add, 0 to destroy, no replacements, with every change either the
managed-bytag or one of the two deliberate changes below.default_tagsaddsmanaged-by = terraform-incubator, which is exactly what the coverage report reads. Route 53 records are not taggable, so they show no tag change.www.311-data.orgCNAME311-data.org->hackforla.github.iohomeunite.usA18.223.160.58-> alias toincubator-prod-lbEvery zone sets
commentexplicitly. The provider defaults that attribute to"Managed by Terraform", so omitting it on the five zones whose live comment is empty would plan a change against a live zone. Two zones already carry that string from the Terragrunt era and keep it.All seven get
lifecycle { prevent_destroy = true }. Destroying a hosted zone discards its delegation NS set, and a recreated zone gets different nameservers, so that outage cannot be undone from Terraform.Fixes
www.311-data.orgwas broken over HTTPS. It CNAME'd to the apex, so requests arrived with SNIwww.311-data.orgagainst a certificate covering the apex only and TLS failed outright — plain HTTP worked, which is why it went unnoticed. Now points athackforla.github.io, the same shape aswww.ballotnav.organdwww.civictechjobs.org, both of which redirect cleanly over HTTPS.homeunite.ushad a dead apex. It pointed at18.223.160.58, a Terragrunt-era host that answers on neither port 80 nor 443 and holds no instance or Elastic IP in this account in any region. The apex is repointed at the load balancer and added to the prod service'sadditional_host_urls, so it reaches the application rather than the listener's default redirect.stage.api.civictechindex.orgis three labels deep and the listener's certificate is*.civictechindex.org, a single-label wildcard, so TLS failed before any request was made. The service now usesapi-stage.civictechindex.org, the spelling the certificate covers and which already worked.Hardcoded zone ids
All four literals are replaced by references. Three resolve within their own module now that the zone lives there. The fourth is cross-project:
peopledepot-dev.vrms.iosits in the vrms zone, soprojects/vrmsgains azone_idoutput andprojects/people-depotavrms_zone_idvariable, wired inmain.tf. Two further literals inprojects/vrms/environment-prod.tfare inside a commented-out block and were left alone.Records deliberately not adopted
Six records serve nothing and are not declared here. Terraform only touches records it declares, so these are removed by hand rather than by this PR — script and pre-change captures are held outside the repo, and the deletions are independent of this apply.
_72ab….www.civictechjobs.orgprod.vrms.io*.vrms.iodev.homeunite.us18.223.160.58stage.api.civictechindex.orgapi-stagetest.civictechindex.orgRemoving
*.vrms.iois the one visible behaviour change: names undervrms.iowith no explicit record will return NXDOMAIN instead of redirecting towww.hackforla.org. Every host named in a listener rule has its own record, so nothing in AWS depends on it.Not in scope
The five ACM validation records are adopted as standalone
aws_route53_recordresources so that no record in a managed zone is left unmanaged. They are temporary owners: when the certificates come into Terraform they should move to afor_eachoverdomain_validation_optionsand these resources be removed. Two orphaned certificates turned up while doing this —civictechjobs.org(issued, attached to nothing) andaccessthedata.org(attached to the load balancer but referenced by no listener rule) — and both belong to that ACM work, not here.NSandSOAapex records are Route 53's own and are deliberately not declared in any zone.