AWS Route53 Terraform modules
Upstream version 6.5.1
1 control from CIS Controls v8.0 IG1 requirements
Terraform Module Source
cisv80ig1.compliance.tf/terraform-aws-modules/route53/aws22 unique
| Name | Type | Default | Description |
|---|---|---|---|
| Enforced · locked by active controls | |||
vpcvpc_security_group_allows_ingress_authorized_ports | map({...}) | null | Configuration block(s) specifying VPC(s) to associate with a private hosted zone. Conflicts with the delegation_set_id argument in this resource and any aws_route53_zone_association resource specifying the same zone ID |
| Optional | |||
comment | string | null | A comment for the hosted zone. Defaults to `Managed by Terraform` |
create | bool | true | Whether to create Route53 zone |
create_dnssec_kms_key | bool | true | Whether to create a KMS key for DNSSEC signing |
create_zone | bool | true | Determines whether to create the Route53 zone or lookup an existing zone |
delegation_set_id | string | null | The ID of the reusable delegation set whose NS records you want to assign to the hosted zone. Conflicts with vpc as delegation sets can only be used for public zones |
dnssec_key_signing_key_name | string | null | Name of the Route 53 key signing key (KSK). When null, the hosted zone name is used. Set this to match an existing KSK when importing or adopting DNSSEC without recreating the key |
dnssec_kms_key_aliases | list(string) | [] | A list of aliases to create. Note - due to the use of `toset()`, values must be static strings and not computed values |
dnssec_kms_key_arn | string | null | The ARN of the KMS key to use for DNSSEC signing. Required when `create_dnssec_kms_key` is `false` |
dnssec_kms_key_description | string | "Route53 DNSSEC KMS Key" | The description of the key as viewed in AWS console |
dnssec_kms_key_tags | map(string) | {} | Additional tags to apply to the KMS key created for DNSSEC signing |
enable_accelerated_recovery | bool | null | Whether to enable Route 53 Accelerated Recovery for the public hosted zone. When enabled, provides a 60-minute RTO for resuming DNS record management if the US East (N. Virginia) Region becomes unavailable. Only applies to public hosted zones |
enable_dnssec | bool | false | Whether to enable DNSSEC for the Route53 zone |
force_destroy | bool | null | Whether to destroy all records (possibly managed outside of Terraform) in the zone when destroying the zone |
ignore_vpc | bool | false | Determines whether to ignore VPC association changes after creation to avoid disruptive diffs when using `aws_route53_zone_association` resource(s). Changing is a destructive action; users should be prepared to use Terraform state move commands/blocks when changing this value |
name | string | "" | This is the name of the hosted zone |
private_zone | bool | false | Whether the hosted zone is private. Only applicable when `create_zone = false` |
records | map({...}) | {} | A map of Route53 records to create in the zone. The key can be used as the subdomain name, or `name` can be used to specify the full name |
tags | map(string) | {} | Tags added to all zones. Will take precedence over tags from the 'zones' variable |
timeouts | object({...}) | null | Timeouts for the Route53 zone operations |
vpc_association_authorizations | map({...}) | null | A map of VPC association authorizations to create for the Route53 zone |
vpc_id | string | null | The ID of the VPC associated with the existing hosted zone. Only applicable when `create_zone = false` |