feat: Add provision to use cross-account route53 for acm dns validation #21

rahul-infra · 2025-11-19T06:28:07Z

Terraform plan for same account:
`Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:

create

Terraform will perform the following actions:

module.acm["base_domain"].aws_acm_certificate.this will be created

resource "aws_acm_certificate" "this" {
- arn = (known after apply)
- domain_name = "kong.staging.gaussb.io"
- domain_validation_options = [
  - {
    - domain_name = "kong.staging.gaussb.io"
    - resource_record_name = (known after apply)
    - resource_record_type = (known after apply)
    - resource_record_value = (known after apply)
      },
      ]
- id = (known after apply)
- key_algorithm = "RSA_2048"
- not_after = (known after apply)
- not_before = (known after apply)
- pending_renewal = (known after apply)
- region = "ap-south-1"
- renewal_eligibility = (known after apply)
- renewal_summary = (known after apply)
- status = (known after apply)
- subject_alternative_names = [
  - "kong.staging.gaussb.io",
    ]
- tags = {
  - "env" = "dev"
    }
- tags_all = {
  - "env" = "dev"
    }
- type = (known after apply)
- validation_emails = (known after apply)
- validation_method = "DNS"
- options (known after apply)
  }

module.acm["base_domain"].aws_acm_certificate_validation.this will be created

resource "aws_acm_certificate_validation" "this" {
- certificate_arn = (known after apply)
- id = (known after apply)
- region = "ap-south-1"
- validation_record_fqdns = (known after apply)
  }

module.acm["base_domain"].aws_route53_record.same_account[0] will be created

resource "aws_route53_record" "same_account" {
- allow_overwrite = true
- fqdn = (known after apply)
- id = (known after apply)
- name = (known after apply)
- records = (known after apply)
- ttl = 60
- type = (known after apply)
- zone_id = "Z0105802SJKE46BQ70GU"
  }

Plan: 3 to add, 0 to change, 0 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.`

Terraform plan for cross account:
`
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:

create

Terraform will perform the following actions:

module.acm["base_domain"].aws_acm_certificate.this will be created

resource "aws_acm_certificate" "this" {
- arn = (known after apply)
- domain_name = "kong.staging.gaussb.io"
- domain_validation_options = [
  - {
    - domain_name = "kong.staging.gaussb.io"
    - resource_record_name = (known after apply)
    - resource_record_type = (known after apply)
    - resource_record_value = (known after apply)
      },
      ]
- id = (known after apply)
- key_algorithm = "RSA_2048"
- not_after = (known after apply)
- not_before = (known after apply)
- pending_renewal = (known after apply)
- region = "ap-south-1"
- renewal_eligibility = (known after apply)
- renewal_summary = (known after apply)
- status = (known after apply)
- subject_alternative_names = [
  - "kong.staging.gaussb.io",
    ]
- tags = {
  - "env" = "dev"
    }
- tags_all = {
  - "env" = "dev"
    }
- type = (known after apply)
- validation_emails = (known after apply)
- validation_method = "DNS"
- options (known after apply)
  }

module.acm["base_domain"].aws_acm_certificate_validation.this will be created

resource "aws_acm_certificate_validation" "this" {
- certificate_arn = (known after apply)
- id = (known after apply)
- region = "ap-south-1"
- validation_record_fqdns = (known after apply)
  }

module.acm["base_domain"].aws_route53_record.cross_account[0] will be created

resource "aws_route53_record" "cross_account" {
- allow_overwrite = true
- fqdn = (known after apply)
- id = (known after apply)
- name = (known after apply)
- records = (known after apply)
- ttl = 60
- type = (known after apply)
- zone_id = "Z0105802SJKE46BQ70GU"
  }

Plan: 3 to add, 0 to change, 0 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now
`

This is the terraform plan when the resource is already created with older version and when user wants to change to newer version:
`terraform plan
module.ecs-deployment_acm["base_domain"].aws_acm_certificate.this: Refreshing state... [id=arn:aws:acm:ap-south-1:471112575944:certificate/51b7aab4-9b03-479a-a4c3-9d3aae34348e]
module.ecs-deployment_acm["base_domain"].aws_route53_record.this[0]: Refreshing state... [id=Z0105802SJKE46BQ70GU__73523f433659a8ecb8b3cbb19ed15127.kong.staging.gaussb.io._CNAME]
module.ecs-deployment_acm["base_domain"].aws_acm_certificate_validation.this: Refreshing state... [id=2025-11-21 05:24:03.256 +0000 UTC]

Terraform will perform the following actions:

module.ecs-deployment_acm["base_domain"].aws_route53_record.this has moved to module.ecs-deployment_acm["base_domain"].aws_route53_record.this[0]

resource "aws_route53_record" "this" {
    id                               = "Z0105802SJKE46BQ70GU__73523f433659a8ecb8b3cbb19ed15127.kong.staging.gaussb.io._CNAME"
    name                             = "_73523f433659a8ecb8b3cbb19ed15127.kong.staging.gaussb.io"
    # (9 unchanged attributes hidden)
}

Plan: 0 to add, 0 to change, 0 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.`

ashwinimanoj · 2025-11-20T09:27:10Z

main.tf

+
+# Cross-account provider for Route53
+provider "aws" {
+  alias  = "dns"


as variable is not allowed here and as description mentions cross-account provider, would it make more sense to call it cross_account_provider?

I have changed the alias from dns to cross_account_provider

ashwinimanoj · 2025-11-20T09:33:29Z

@rahul-infra Possible to paste result of terraform plan with an example for these changes?
You can add for one with cross account and one without it.

ashwinimanoj · 2025-11-20T09:37:45Z

modules/acm/main.tf

+  allow_overwrite = var.record_allow_overwrite
+}
+
+resource "aws_route53_record" "cross_account" {


let's have the name as something more descriptive than same account and cross account.
also wouldn't changing name of existing resource require a destroy and create? We should avoid it in that case and only use a different name for the new aws_route53_record resource being added.

I made this change from 'same_account' to 'this' such that it doesnt destroy and create resources If user wants to change only the version.

ashwinimanoj · 2025-11-20T09:38:30Z

versions.tf

    aws = {
      source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"


why did we update from 5.0 to 6.0?
are there any breaking changes when moving from 5.0 to 6.0?

This shouldn't be a breaking change @ashwinimanoj .

There are many breaking changes according to release notes:
https://github.com/hashicorp/terraform-provider-aws/releases/tag/v6.0.0

Not sure how many of them apply here

For reference: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-6-upgrade

I checked the release notes for AWS Provider Version 6,
I can see those upgrades doesn't have any breaking changes .

…same account or different account. fix : removed extra space. fix: removed unwanted region in my acm module. fix : updated aws support provider. fix : updated aws version. fix : formatted main file. fix: removed region from passing to my acm module. Made changes in pre-commit file excluded acm main.tf file.

… branch. terraform-docs: automated action feat: added route53 arn and region in examples. Removed extra space in my example variabes.tf

ashwinimanoj · 2025-11-21T07:17:12Z

modules/acm/main.tf

  }
 }

+terraform {


move this terraform block to providers.tf

Moved providers into providers.tf file.

….com/infraspecdev/terraform-aws-ecs-deployment into feature/route53-cross-account-access

rahul-infra changed the title ~~feat : Add provision to use cross-account Route53 for ACM DNS validation~~ feat : add provision to use cross-account Route53 for ACM DNS validation Nov 19, 2025

rahul-infra changed the title ~~feat : add provision to use cross-account Route53 for ACM DNS validation~~ feat : add provision to use cross-account route53 for acm dns validation Nov 19, 2025

rahul-infra changed the title ~~feat : add provision to use cross-account route53 for acm dns validation~~ feat: add provision to use cross-account route53 for acm dns validation Nov 19, 2025

ashwinimanoj changed the title ~~feat: add provision to use cross-account route53 for acm dns validation~~ feat: Add provision to use cross-account route53 for acm dns validation Nov 19, 2025

ashwinimanoj reviewed Nov 20, 2025

View reviewed changes

rahul-infra added 2 commits November 20, 2025 15:52

fix: changed github.ref to pullrequest.ref since it points the actual…

f28365f

… branch. terraform-docs: automated action feat: added route53 arn and region in examples. Removed extra space in my example variabes.tf

rahul-infra force-pushed the feature/route53-cross-account-access branch from c5747c5 to f28365f Compare November 20, 2025 10:38

rahul-infra and others added 2 commits November 21, 2025 11:47

Updated main.tf for acm module.

e1e0782

terraform-docs: automated action

8da19a2

rahul-infra requested a review from ashwinimanoj November 21, 2025 06:25

ashwinimanoj reviewed Nov 21, 2025

View reviewed changes

Moved providers into seperate file.

5b252ca

rahul-infra requested a review from ashwinimanoj November 21, 2025 12:15

Merge branch 'feature/route53-cross-account-access' of https://github…

1f608b0

….com/infraspecdev/terraform-aws-ecs-deployment into feature/route53-cross-account-access

feat: Add provision to use cross-account route53 for acm dns validation #21

Are you sure you want to change the base?

feat: Add provision to use cross-account route53 for acm dns validation #21

Uh oh!

Conversation

rahul-infra commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

module.acm["base_domain"].aws_acm_certificate.this will be created

module.acm["base_domain"].aws_acm_certificate_validation.this will be created

module.acm["base_domain"].aws_route53_record.same_account[0] will be created

module.acm["base_domain"].aws_acm_certificate.this will be created

module.acm["base_domain"].aws_acm_certificate_validation.this will be created

module.acm["base_domain"].aws_route53_record.cross_account[0] will be created

module.ecs-deployment_acm["base_domain"].aws_route53_record.this has moved to module.ecs-deployment_acm["base_domain"].aws_route53_record.this[0]

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashwinimanoj commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashwinimanoj Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashwinimanoj Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rahul-infra commented Nov 19, 2025 •

edited

Loading

ashwinimanoj commented Nov 20, 2025 •

edited

Loading

ashwinimanoj Nov 20, 2025 •

edited

Loading

ashwinimanoj Nov 21, 2025 •

edited

Loading