Package: aws-cdk.aws-route53
Amazon Route53 Construct Library---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.For more information on how to migrate, see theMigrating to AWS CDK v2guide.To add a public hosted zone:route53.PublicHostedZone(self,"HostedZone",zone_name="fully.qualified.domain.com")To add a private hosted zone, usePrivateHostedZone. Note thatenableDnsHostnamesandenableDnsSupportmust have been enabled for the
VPC you're configuring for private hosted zones.# vpc: ec2.Vpczone=route53.PrivateHostedZone(self,"HostedZone",zone_name="fully.qualified.domain.com",vpc=vpc)Additional VPCs can be added withzone.addVpc().Adding RecordsTo add a TXT record to your zone:# my_zone: route53.HostedZoneroute53.TxtRecord(self,"TXTRecord",zone=my_zone,record_name="_foo",# If the name ends with a ".", it will be used as-is;# if it ends with a "." followed by the zone name, a trailing "." will be added automatically;# otherwise, a ".", the zone name, and a trailing "." will be added automatically.# Defaults to zone root if not specified.values=["Bar!","Baz?"],ttl=Duration.minutes(90))To add a NS record to your zone:# my_zone: route53.HostedZoneroute53.NsRecord(self,"NSRecord",zone=my_zone,record_name="foo",values=["ns-1.awsdns.co.uk.","ns-2.awsdns.com."],ttl=Duration.minutes(90))To add a DS record to your zone:# my_zone: route53.HostedZoneroute53.DsRecord(self,"DSRecord",zone=my_zone,record_name="foo",values=["12345 3 1 123456789abcdef67890123456789abcdef67890"],ttl=Duration.minutes(90))To add an A record to your zone:# my_zone: route53.HostedZoneroute53.ARecord(self,"ARecord",zone=my_zone,target=route53.RecordTarget.from_ip_addresses("1.2.3.4","5.6.7.8"))To add an A record for an EC2 instance with an Elastic IP (EIP) to your zone:# instance: ec2.Instance# my_zone: route53.HostedZoneelastic_ip=ec2.CfnEIP(self,"EIP",domain="vpc",instance_id=instance.instance_id)route53.ARecord(self,"ARecord",zone=my_zone,target=route53.RecordTarget.from_ip_addresses(elastic_ip.ref))To add an AAAA record pointing to a CloudFront distribution:importaws_cdk.aws_cloudfrontascloudfront# my_zone: route53.HostedZone# distribution: cloudfront.CloudFrontWebDistributionroute53.AaaaRecord(self,"Alias",zone=my_zone,target=route53.RecordTarget.from_alias(targets.CloudFrontTarget(distribution)))Constructs are available for A, AAAA, CAA, CNAME, MX, NS, SRV and TXT records.Use theCaaAmazonRecordconstruct to easily restrict certificate authorities
allowed to issue certificates for a domain to Amazon only.To add a NS record to a HostedZone in different account you can do the following:In the account containing the parent hosted zone:parent_zone=route53.PublicHostedZone(self,"HostedZone",zone_name="someexample.com",cross_account_zone_delegation_principal=iam.AccountPrincipal("12345678901"),cross_account_zone_delegation_role_name="MyDelegationRole")In the account containing the child zone to be delegated:sub_zone=route53.PublicHostedZone(self,"SubZone",zone_name="sub.someexample.com")# import the delegation role by constructing the roleArndelegation_role_arn=Stack.of(self).format_arn(region="",# IAM is global in each partitionservice="iam",account="parent-account-id",resource="role",resource_name="MyDelegationRole")delegation_role=iam.Role.from_role_arn(self,"DelegationRole",delegation_role_arn)# create the recordroute53.CrossAccountZoneDelegationRecord(self,"delegate",delegated_zone=sub_zone,parent_hosted_zone_name="someexample.com",# or you can use parentHostedZoneIddelegation_role=delegation_role)ImportsIf you don't know the ID of the Hosted Zone to import, you can use theHostedZone.fromLookup:route53.HostedZone.from_lookup(self,"MyZone",domain_name="example.com")HostedZone.fromLookuprequires an environment to be configured. Check
out thedocumentationfor more documentation and examples. CDK
automatically looks into your~/.aws/configfile for the[default]profile.
If you want to specify a different account runcdk deploy --profile [profile].new MyDevStack(app, 'dev', {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  },
});If you know the ID and Name of a Hosted Zone, you can import it directly:zone=route53.HostedZone.from_hosted_zone_attributes(self,"MyZone",zone_name="example.com",hosted_zone_id="ZOJJZC49E0EPZ")Alternatively, use theHostedZone.fromHostedZoneIdto import hosted zones if
you know the ID and the retrieval for thezoneNameis undesirable.zone=route53.HostedZone.from_hosted_zone_id(self,"MyZone","ZOJJZC49E0EPZ")You can import a Public Hosted Zone as well with the similarPubicHostedZone.fromPublicHostedZoneIdandPubicHostedZone.fromPublicHostedZoneAttributesmethods:zone_from_attributes=route53.PublicHostedZone.from_public_hosted_zone_attributes(self,"MyZone",zone_name="example.com",hosted_zone_id="ZOJJZC49E0EPZ")# Does not know zoneNamezone_from_id=route53.PublicHostedZone.from_public_hosted_zone_id(self,"MyZone","ZOJJZC49E0EPZ")VPC Endpoint Service Private DNSWhen you create a VPC endpoint service, AWS generates endpoint-specific DNS hostnames that consumers use to communicate with the service.
For example, vpce-1234-abcdev-us-east-1.vpce-svc-123345.us-east-1.vpce.amazonaws.com.
By default, your consumers access the service with that DNS name.
This can cause problems with HTTPS traffic because the DNS will not match the backend certificate:curl: (60) SSL: no alternative certificate subject name matches target host name 'vpce-abcdefghijklmnopq-rstuvwx.vpce-svc-abcdefghijklmnopq.us-east-1.vpce.amazonaws.com'Effectively, the endpoint appears untrustworthy. To mitigate this, clients have to create an alias for this DNS name in Route53.Private DNS for an endpoint service lets you configure a private DNS name so consumers can
access the service using an existing DNS name without creating this Route53 DNS alias
This DNS name can also be guaranteed to match up with the backend certificate.Before consumers can use the private DNS name, you must verify that you have control of the domain/subdomain.Assuming your account has ownership of the particular domain/subdomain,
this construct sets up the private DNS configuration on the endpoint service,
creates all the necessary Route53 entries, and verifies domain ownership.fromaws_cdk.coreimportStackfromaws_cdk.aws_ec2importVpc,VpcEndpointServicefromaws_cdk.aws_elasticloadbalancingv2importNetworkLoadBalancerfromaws_cdk.aws_route53importPublicHostedZone,VpcEndpointServiceDomainNamestack=Stack()vpc=Vpc(stack,"VPC")nlb=NetworkLoadBalancer(stack,"NLB",vpc=vpc)vpces=VpcEndpointService(stack,"VPCES",vpc_endpoint_service_load_balancers=[nlb])# You must use a public hosted zone so domain ownership can be verifiedzone=PublicHostedZone(stack,"PHZ",zone_name="aws-cdk.dev")VpcEndpointServiceDomainName(stack,"EndpointDomain",endpoint_service=vpces,domain_name="my-stuff.aws-cdk.dev",public_hosted_zone=zone)