How to set up DNSSEC with Terraform on AWS?

Use this module's enable_dnssec and create_dnssec_kms_key variables. It automatically provisions KMS keys and signing keys, but you'll need to provide the DS record outputs to your domain registrar for full enablement.

Terraform Route53 module vs. writing raw Terraform code?

This module saves time and ensures best practices for complex setups like advanced routing or DNSSEC. For very simple, static DNS records, raw Terraform might be more transparent and avoid module dependencies.

How to manage cross-account VPC associations for private hosted zones?

Use vpc_association_authorizations in the zone owner account's module to authorize associations, then create aws_route53_zone_association resources in the VPC owner account—note that the association itself is outside the module scope.

Best practices for weighted DNS routing in AWS using Terraform?

Define records with set_identifier and weighted_routing_policy in the module's records map. Adjust weights over time for blue-green deployments, and monitor health checks if integrated for failover scenarios.

How to avoid destructive changes when modifying VPC associations?

Plan carefully with the ignore_vpc parameter; if changes are needed, follow the README's state move commands to migrate between aws_route53_zone resources, and test in a non-production environment first.

Does this module support Route53 Resolver endpoints?

Yes, but through separate sub-modules like resolver-endpoint and resolver-firewall-rule-group, which require additional configuration outside the main zone module for complete resolver setup.

Open-Awesome

terraform-aws-route53

Apache-2.0HCLv6.5.0

A Terraform module for creating and managing AWS Route53 hosted zones, DNS records, and DNSSEC configurations.

Visit Website GitHub

156 stars235 forks0 contributors

What is terraform-aws-route53?

terraform-aws-route53 is a Terraform module that automates the creation and management of AWS Route53 DNS resources. It provides a declarative way to define hosted zones, DNS records with advanced routing policies, DNSSEC configurations, and cross-account VPC associations. The module solves the problem of manually configuring complex DNS setups through the AWS console or writing repetitive Terraform code.

Target Audience

DevOps engineers, SREs, and cloud infrastructure teams managing DNS on AWS who want to implement infrastructure-as-code practices for their Route53 configurations.

Value Proposition

Developers choose this module because it's part of the trusted terraform-aws-modules ecosystem, reduces boilerplate Terraform code, supports advanced Route53 features like DNSSEC and complex routing policies, and follows AWS best practices. It's maintained by experienced contributors and widely used in production environments.

Overview

Terraform module to create AWS Route53 resources 🇺🇦

Use Cases

Best For

Managing DNS for multi-region applications with latency-based routing
Implementing blue-green deployments using weighted DNS routing policies
Securing DNS zones with DNSSEC and KMS-managed signing keys
Creating private hosted zones for internal VPC-based services
Setting up disaster recovery DNS configurations with failover routing
Managing DNS across multiple AWS accounts with cross-account VPC associations

Not Ideal For

Projects with only a handful of static DNS records that don't require advanced routing or DNSSEC
Teams exclusively using CloudFormation, CDK, or other IaC tools instead of Terraform
Organizations with strict security policies prohibiting third-party Terraform modules
Simple internal DNS setups where AWS Console or basic scripts suffice

Pros & Cons

Pros

Comprehensive Routing Policies

Supports all AWS Route53 routing types—geolocation, weighted, failover, latency, and more—as shown in the detailed example code with multiple policy configurations.

Integrated DNSSEC with KMS

Simplifies DNSSEC enablement by automatically creating and managing KMS keys for signing, reducing manual security setup steps.

Cross-Account VPC Support

Facilitates private hosted zone associations across AWS accounts using vpc_association_authorizations, essential for multi-account cloud architectures.

Modular and Flexible Design

Includes sub-modules for delegation sets and resolver resources, plus extensive input variables for customization while following Terraform best practices.

Cons

State Management Complexity

Changing the ignore_vpc parameter requires manual Terraform state moves, which can be error-prone and lead to disruptive zone recreation if not handled carefully.

Over-Engineering for Basics

The module's feature-rich design adds unnecessary complexity for simple DNS needs, making it harder to onboard teams with limited Terraform or Route53 experience.

AWS Lock-In

Tightly coupled with AWS Route53, so it's not suitable for multi-cloud DNS management or migrating to other DNS providers without significant rework.

Frequently Asked Questions

Related Projects

terraform-aws-eks

Terraform module to create Amazon Elastic Kubernetes (EKS) resources 🇺🇦

Stars4,988

Forks4,404

Last commit29 days ago

terraform-aws-vpc

Terraform module to create AWS VPC resources 🇺🇦

Stars3,249

Forks4,631

Last commit3 months ago

stack

A set of Terraform modules for configuring production infrastructure with AWS

Stars2,089

Forks410

Last commit3 years ago

typhoon

Minimal and free Kubernetes distribution with Terraform

Stars2,046

Forks324

Last commit1 day ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub