Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Add route53 integration #37

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

pecirep
Copy link

@pecirep pecirep commented Mar 4, 2021

Disclaimer: While this branch "works", it is not yet suited for production

Introduces automated domain management using route53, including automated SSL certificate requests and validations.
If one or more domains aren't managed by a Hosted Zone in your account, the required DNS entries will be written to the console.
If there is no issued SSL certificate for all domains combined and one or more aren't managed by a Hosted Zone in your account, deployment will wait for the DNS entries to be added manually and the certificate to be issued.

I'm already using this in a project and have done some testing, but it would be a great if a few more people could try it out and provide feedback. I also need feedback/input for the following problems:

  • currently there is no cleanup. if the stack is remove the certificates won't be deleted, neither will the domains. I'm wondering how best to approach this to make sure certificates and DNS entries that weren't created by the plugin for this stack aren't deleted as well. Should I add tags/comments to thsoe resources and only delete resources that have the tags? doesn't seem like a particularly elegant, as one could have 2 domains in the stack initially, then remove one from the config and then delete the stack. to delete the removed domain and it's cert as well all DNS entries and certs in the account would have to be queried for the tags... maybe someone has a better idea.
  • should certificate requests just be done automatically if the parameter isn't set in the config but a domain is defined? The plugin would output the necessary domains to the console and wait for it to be issued. currently this is only done if the route53 parameter is set to true.

All suggestions are welcome, I think this would be a nice addition to the plugin if done properly.

@pecirep pecirep changed the title Add route53 integration WIP: Add route53 integration Mar 4, 2021
 - automatically create ALIAS record(s) for distribution
 - automatically request and certificate using route53
@pecirep
Copy link
Author

pecirep commented Feb 14, 2022

I've simplified my code a bit and left automated fetching of existing ACM certificates for a separate PR. More importantly, CloudFormation resources are created instead of making API calls, which means certificates and DNS entries will automatically be deleted when the the corresponding stage is removed, even if config changes are made between deployments that otherwise require manual cleanup. This basically automates the manual steps proposed for documentation in #42 (thank you btw, this was very useful to me) but also extends them to certificate creation using DNS validation.
As before, the AWS API is used to find hosted zones for the provided domains if there are multiple. I'm happy with the code in it's current state but while I don't expect it to be an issue I still want to leave this as a draft until someone can test multi-hosted-zone-setups and mixed setups where at least one domain has a corresponding hosted zone in Route53 and at least one doesn't.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant