Manages Route 53 Hosted Zone Domain Name System Security Extensions (DNSSEC). For more information about managing DNSSEC in Route 53, see the Route 53 Developer Guide.
provider "aws" {
region = "us-east-1"
}
data "aws_caller_identity" "current" {}
resource "aws_kms_key" "example" {
customer_master_key_spec = "ECC_NIST_P256"
deletion_window_in_days = 7
key_usage = "SIGN_VERIFY"
policy = jsonencode({
Statement = [
{
Action = [
"kms:DescribeKey",
"kms:GetPublicKey",
"kms:Sign",
"kms:Verify",
],
Effect = "Allow"
Principal = {
Service = "dnssec-route53.amazonaws.com"
}
Resource = "*"
Sid = "Allow Route 53 DNSSEC Service",
},
{
Action = "kms:*"
Effect = "Allow"
Principal = {
AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
}
Resource = "*"
Sid = "Enable IAM User Permissions"
},
]
Version = "2012-10-17"
})
}
resource "aws_route53_zone" "example" {
name = "example.com"
}
resource "aws_route53_key_signing_key" "example" {
hosted_zone_id = aws_route53_zone.example.id
key_management_service_arn = aws_kms_key.example.arn
name = "example"
}
resource "aws_route53_hosted_zone_dnssec" "example" {
depends_on = [
aws_route53_key_signing_key.example
]
hosted_zone_id = aws_route53_key_signing_key.example.hosted_zone_id
}
The following arguments are required:
hosted_zone_id
- (Required) Identifier of the Route 53 Hosted Zone.The following arguments are optional:
signing_status
- (Optional) Hosted Zone signing status. Valid values: SIGNING
, NOT_SIGNING
. Defaults to SIGNING
.This resource exports the following attributes in addition to the arguments above:
id
- Route 53 Hosted Zone identifier.In Terraform v1.5.0 and later, use an import
block to import aws_route53_hosted_zone_dnssec
resources using the Route 53 Hosted Zone identifier. For example:
import {
to = aws_route53_hosted_zone_dnssec.example
id = "Z1D633PJN98FT9"
}
Using terraform import
, import aws_route53_hosted_zone_dnssec
resources using the Route 53 Hosted Zone identifier. For example:
% terraform import aws_route53_hosted_zone_dnssec.example Z1D633PJN98FT9