Route 53
Amazon Route 53 is the AWS DNS service: it hosts the zones that turn names such as api.prod.company.com into addresses. The platform keeps every public zone in one account, one private zone in the network account, and lets workload accounts write only the records they need.
What it does
A hosted zone holds the records for one domain. A public zone answers the internet; a private zone answers only the VPCs it is associated with. A parent zone delegates a subdomain by publishing NS records that point at the child zone. DNSSEC signs a zone so resolvers can verify answers were not forged; the chain of trust runs from the root down, so a parent must be signed before a child's signature means anything. Query logging records the questions a public zone receives.
How BuiltForProd uses it
Public DNS lives in core-dns. The route53-zones unit (module modules/route53-zones, listed by core/dns/global) creates the apex zone for domain_name from common.hcl, which is the one place the domain is set, plus one subdomain zone per stage: prod., staging., dev. and sandbox.company.com. NS delegation records are written into the parent automatically. additional_domains repeats the pattern for further domains. The registrar delegates the apex to Route 53.
Integrity controls apply to the zones that carry customer traffic. dnssec_zones and query_logging_zones are both set to ["apex", "prod", "staging"]. Each signed zone gets an asymmetric KMS key in us-east-1 (about $1 per month), a key-signing key and a DS record in the apex; the apex DS record is an output published at the registrar. Query logs go to one CloudWatch log group per zone, /aws/route53/<zone>, kept 365 days. dev and sandbox are left unsigned and unlogged for cost.
Private DNS lives in core-network. The private-zone unit creates internal.company.com as a private zone associated with the hub VPC; the private-zone-association unit in each workload account authorizes and associates its spoke VPC through an aliased provider in the network account. The hub resolver is pushed to Client VPN clients so the zone resolves over the VPN.
Workload accounts never hold zone credentials. They assume acme-route53-cross-account, created by the zone units in core-dns and core-network and trusted by the plat-* accounts, to write two kinds of record: ACM validation records, and the records that ExternalDNS publishes from Kubernetes Ingress host names: public names such as blueprint-api.dev.company.com into the stage zone, and any host under internal.company.com into the private zone. The frontend CDN module adds an alias record for its CloudFront distribution the same way.
Terms you will see
| Term | Meaning |
|---|---|
| Hosted zone | The container of DNS records for one domain. |
| Apex | The top of the domain, company.com, as opposed to a subdomain. |
| Delegation | NS records in a parent that hand a subdomain to another zone. |
| DS record | The record in a parent that vouches for a signed child zone. |
| Key-signing key (KSK) | The DNSSEC key, held in KMS, that signs the zone's keys. |
| Private hosted zone | A zone visible only inside associated VPCs. |
| Alias record | A Route 53 record that points at an AWS resource such as a CloudFront distribution. |
Where to read more
- AWS Baseline overview for the DNS and network accounts in context.
- ACM for the certificates validated through these zones.
- ExternalDNS for the records Kubernetes writes automatically.