awslabs / aws-bootstrap-kit

Apache License 2.0
104 stars 22 forks source link

add auto resolution of dns delegation parameter #9

Closed flochaz closed 3 years ago

flochaz commented 3 years ago

Context

This PR enable customers to easily manage their DNS records in a secure way.

SDLC organization update

  1. A DNS root domain (yourdomain.com for instance) is created in main account thanks to the specification of a new props for SDLC organization: rootHostedZoneDNSName (PS: nothing change if not specified).
  2. A set of sub zone will be created for each stage (dev.yourdomain.com for the case of Dev account) in main account as well as a role (Dev.yourdomain.com-dns-update for the case of Dev account) assumable only by the specific stage account and only permitted to modify its stage sub zone.
  3. Each stage will be added as delegated administrator to be able to listAccounts and auto resolve root zone dns hosting account

app level API update

  1. Then the client can simply add

    const rootDomain = "yourdomain.com";
    const serviceName = "landingpage";
    const stage = props.stage';
    const URL = `${serviceName}.${stage}.${rootDomain}`;
    
    const delegatedHostedZone = new bootstrapKit.CrossAccountDNSDelegator(this, "subzoneDelegation", {
      zoneName: URL,
    });
  2. A app sub zone (landingpage.dev.yourdomain.com) will be created in each stage account
  3. A NS record (landingpage.dev.yourdomain.com) will be created in each stage sub zone hosted in main account to point to the previously mentioned app sub zone (landingpage.dev.yourdomain.com) hosted in each stage account
  4. the app sub zone can then be used has a standard zone in route53 such as creating SSL certificate with auto validation, CNAME to cloudfront etc.

Unit tests

---------------------------------------------------|---------|----------|---------|---------|---------------------
File                                               | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s   
---------------------------------------------------|---------|----------|---------|---------|---------------------
All files                                          |   95.27 |    74.32 |   93.55 |   95.27 |                     
 lib                                               |   96.43 |    63.89 |   88.89 |   96.43 |                     
  account-provider.ts                              |     100 |      100 |     100 |     100 |                     
  account.ts                                       |   89.47 |    66.67 |      50 |   89.47 | 156-162             
  aws-config-recorder.ts                           |     100 |      100 |     100 |     100 |                     
  aws-organizations-stack.ts                       |   93.33 |    61.11 |      80 |   93.33 | 112,120,139         
  dns.ts                                           |   95.45 |     62.5 |     100 |   95.45 | 65                  
  index.ts                                         |     100 |      100 |     100 |     100 |                     
  organization-trail.ts                            |     100 |       50 |     100 |     100 | 145                 
  organization.ts                                  |     100 |      100 |     100 |     100 |                     
  organizational-unit.ts                           |     100 |      100 |     100 |     100 |                     
  secure-root-user.ts                              |     100 |      100 |     100 |     100 |                     
 lib/account-handler                               |     100 |    94.74 |     100 |     100 |                     
  index.ts                                         |     100 |    94.74 |     100 |     100 | 48                  
 lib/dns                                           |     100 |       50 |     100 |     100 |                     
  cross-account-dns-delegator.ts                   |     100 |      100 |     100 |     100 |                     
  cross-account-zone-delegation-record-provider.ts |     100 |       50 |     100 |     100 | 61                  
  cross-account-zone-delegation-record.ts          |     100 |      100 |     100 |     100 |                     
 lib/dns/delegation-record-handler                 |   86.79 |    76.47 |     100 |   86.79 |                     
  index.ts                                         |   86.79 |    76.47 |     100 |   86.79 | 113,173-184,249-250 
---------------------------------------------------|---------|----------|---------|---------|---------------------

Test Suites: 7 passed, 7 total
Tests:       13 passed, 13 total
Snapshots:   0 total
Time:        15.315 s
Ran all test suites.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.