AWS Route53 Zone Primitive Module

Overview

This Terraform module creates an AWS Route53 hosted zone. It wraps the aws_route53_zone resource and supports both public and private hosted zones.

Upgrade impact: private zone VPC nested blocks

Older releases used a dynamic "vpc" block with a placeholder instance key ("0") when only vpc_id was set. This module keeps that address when vpc_id is set and vpc_associations is empty, so upgrades for that common case should not show nested vpc destroy/create churn from Terraform addressing alone.

When vpc_associations is non-empty, nested blocks use for_each keys equal to vpc_id (merged with legacy vpc_id / vpc_region when both are set). If you previously had only vpc_id in state under vpc["0"] and you start passing vpc_associations, expect a one-time nested address change ("0" to your VPC ID string). Review terraform plan carefully. You can use a moved block in the root configuration with literal addresses (for example from module.zone.aws_route53_zone.zone.vpc["0"] to module.zone.aws_route53_zone.zone.vpc["vpc-0123456789abcdef0"]) if your module label and VPC ID are fixed for that workspace.

Validation: conflicting vpc_region values for the same vpc_id are rejected by lifecycle preconditions on aws_route53_zone.zone (plan fails; not a check block). Public zones (no VPC arguments) are unaffected.

Usage

module "zone" {
  source = "terraform.registry.launch.nttdata.com/module_primitive/route53_zone/aws"
  version = "~> 1.0"

  name   = "example.com"
  tags   = var.tags
}

See the complete example for a full working example with resource naming.

Prerequisites

• asdf or mise for tool version management
• make
• repo for pulling components

Repo Init

make configure

Local Testing

1. Set AWS credentials (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION or use a profile).
2. For the example, ensure base_domain in examples/complete/test.tfvars is a domain you own.
3. Run validation (includes terraform-test for the VPC merge harness, then platform lint / test from components/ when that tree is present after make configure):

make check

To run only the locals-only harness (terraform test under tests/unit/vpc_associations_merge/, no AWS provider):

make terraform-test

Pre-Commit Hooks

The .pre-commit-config.yaml defines hooks for Terraform, Go, and linting. The commitlint hook enforces conventional commit messages.

The detect-secrets-hook prevents new secrets from being introduced. See pre-commit hooks documentation for details.

To install the commit message hook:

pre-commit install --hook-type commit-msg

Requirements

Name	Version
terraform	~> 1.10
aws	>= 5.0, < 7.0

Modules

No modules.

Resources

Name	Type
aws_route53_zone.zone	resource
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
comment	A comment for the hosted zone. Defaults to 'Managed by Terraform' when null.	string	null	no
delegation_set_id	The ID of the reusable delegation set whose NS records you want to assign to the hosted zone. Conflicts with any private zone VPC association (vpc_id and/or vpc_associations).	string	null	no
force_destroy	Whether to destroy all records (possibly managed outside of Terraform) in the zone when destroying the zone.	bool	false	no
name	The name of the hosted zone (domain name).	string	n/a	yes
tags	Map of tags to assign to the hosted zone.	map(string)	{}	no
vpc_associations	VPC associations for a private hosted zone. When vpc_id is also set, entries are merged after the legacy vpc_id (same vpc_id: last occurrence wins). Resolved map key is vpc_id (list order does not matter). Duplicate vpc_id entries must use the same vpc_region; the last entry wins. Conflicts with delegation_set_id.	list(object({ vpc_id = string vpc_region = optional(string) }))	[]	no
vpc_id	Single VPC to associate with a private hosted zone (legacy). Use vpc_associations for multiple VPCs. Combined with vpc_associations when both are set. Conflicts with delegation_set_id.	string	null	no
vpc_region	Region for vpc_id when set. Defaults to the region of the AWS provider when null.	string	null	no

Outputs

Name	Description
arn	The ARN of the hosted zone.
id	The ID of the resource (same as the zone_id).
name	The name of the hosted zone.
name_servers	A list of name servers in the associated (or default) delegation set.
primary_name_server	The Route 53 name server that created the SOA record.
tags_all	A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
zone_id	The Hosted Zone ID. This can be referenced by zone records.

Requirements

Name	Version
terraform	~> 1.10
aws	>= 5.0, < 7.0

Providers

Name	Version
aws	6.39.0

Modules

Name	Source	Version
resource_names	terraform.registry.launch.nttdata.com/module_library/resource_name/launch	~> 2.0
zone	../..	n/a

Resources

Name	Type
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
base_domain	Base domain for the hosted zone (e.g., launch.nttdata.com). Must be a domain you own.	string	n/a	yes
class_env	Environment class (e.g., dev, prod).	string	"dev"	no
comment	A comment for the hosted zone.	string	null	no
delegation_set_id	The ID of the reusable delegation set. Conflicts with vpc_id and vpc_associations.	string	null	no
force_destroy	Whether to destroy all records in the zone when destroying the zone.	bool	false	no
instance_env	Instance environment number.	string	"000"	no
instance_resource	Instance resource identifier.	string	"000"	no
logical_product_family	Name of the product family for which the resource is created.	string	"launch"	no
logical_product_service	Name of the product service for which the resource is created.	string	"dns"	no
resource_names_map	Map of key to resource_name for the resource_name module.	map(object({ name = string max_length = optional(number, 60) }))	{ "route53_zone": { "max_length": 63, "name": "r53" } }	no
tags	Map of tags to assign to the hosted zone.	map(string)	{}	no
vpc_associations	VPC associations for a private hosted zone (order-independent). Conflicts with delegation_set_id.	list(object({ vpc_id = string vpc_region = optional(string) }))	[]	no
vpc_id	Single VPC for a private hosted zone (legacy). Conflicts with delegation_set_id.	string	null	no
vpc_region	Region for vpc_id when set. Defaults to the region of the AWS provider when null.	string	null	no

Outputs

Name	Description
arn	The ARN of the hosted zone.
id	The ID of the hosted zone (same as the zone_id).
name	The name of the hosted zone.
name_servers	A list of name servers in the delegation set.
zone_id	The Hosted Zone ID.