search

cisagov / cool-dns-cyber.dhs.gov

Terraform configuration to create and populate the cyber.dhs.gov zone.
Creative Commons Zero v1.0 Universal
3 stars 9 forks source link

Add new route53 file with DNS changes for Readysetcyber and XFD #97

Closed cduhn17 closed 7 months ago

cduhn17 commented 7 months ago

🗣 Description

Add CAA,A, AAAA DNS record changes to allow digicert to verify domain ownership

💭 Motivation and context

The CAA,A, AAAA record changes are required by digicert to create SSL certificates

✅ Pre-approval checklist

jsf9k commented 7 months ago

I tried to apply these changes, but I get an error:

│ Error: creating Route 53 Record: InvalidChangeBatch: [RRSet of type CAA with DNS name readysetcyber.cyber.dhs.gov. is not permitted because a conflicting RRSet of type CNAME with the same DNS name already exists in zone cyber.dhs.gov.]
│       status code: 400, request id: b6918389-d3de-4130-8b6f-297f76165e24
│ 
│   with aws_route53_record.ready_set_cyber_prod_digicert_CAA,
│   on route53_readysetcyber_app.tf line 12, in resource "aws_route53_record" "ready_set_cyber_prod_digicert_CAA":
│   12: resource "aws_route53_record" "ready_set_cyber_prod_digicert_CAA" {
│ 
╵
â•·
│ Error: creating Route 53 Record: InvalidChangeBatch: [RRSet of type CAA with DNS name api.readysetcyber.cyber.dhs.gov. is not permitted because a conflicting RRSet of type CNAME with the same DNS name already exists in zone cyber.dhs.gov.]
│       status code: 400, request id: ecb8ec2b-be44-4a49-b112-aa731cdf08ea
│ 
│   with aws_route53_record.api_ready_set_cyber_prod_digicert_CAA,
│   on route53_readysetcyber_app.tf line 36, in resource "aws_route53_record" "api_ready_set_cyber_prod_digicert_CAA":
│   36: resource "aws_route53_record" "api_ready_set_cyber_prod_digicert_CAA" {

Also, the failing lint job needs to be addressed.

jsf9k commented 7 months ago

@cduhn17 - This PR still has an issue. There are multiple CAA records for both api.readysetcyber.cyber.dhs.gov and readysetcyber.cyber.dhs.gov. That isn't something I can fix for you. In each case, one of the duplicate records must be removed.

cduhn17 commented 7 months ago

@jsf9k How are you using terraform-docs so that i don't mess up the README.md again after making changes to other .tf files?

jsf9k commented 7 months ago

@jsf9k How are you using terraform-docs so that i don't mess up the README.md again after making changes to other .tf files?

You should only have to do this:

  1. Run terraform-docs . from the repo's root directory.
  2. Open README.md and make sure that the Markdown heading tags are closed. For example, ## Requirements should instead be ## Requirements ##.

Once terraform-docs/terraform-docs#745 is merged the second step will no longer be necessary.

jsf9k commented 7 months ago

@cduhn - You didn't do step 2 when you created commit 57d89aa, so I did it for you in commit 2ebd027.

jsf9k commented 7 months ago

@cduhn17 - I applied these changes successfully. Let me know if you are happy with them.

jsf9k commented 7 months ago

@cduhn17 - Please update the description of this PR to match what you actually did. I think you created A, AAAA, and CAA records but the first two are not currently mentioned in the PR description. CNAME records are mentioned in the PR description, but I don't think any were created here.

cduhn17 commented 7 months ago

@jsf9k , When I opened up the PR we were going to add CNAME records and have since removed them and added A and AAAA. I believe that is what was causing the errors that you sent to me. The certs have both been created as a result of the changes in this PR.

jsf9k commented 7 months ago

@jsf9k , When I opened up the PR we were going to add CNAME records and have since removed them and added A and AAAA. I believe that is what was causing the errors that you sent to me. The certs have both been created as a result of the changes in this PR.

When the contents of a PR change, the PR description should be updated accordingly. The PR description should always describe the changes in the PR. Can you update the description for this PR to match the changes that are actually being made?

cduhn17 commented 7 months ago

@jsf9k , When I opened up the PR we were going to add CNAME records and have since removed them and added A and AAAA. I believe that is what was causing the errors that you sent to me. The certs have both been created as a result of the changes in this PR.

When the contents of a PR change, the PR description should be updated accordingly. The PR description should always describe the changes in the PR. Can you update the description for this PR to match the changes that are actually being made?

@jsf9k Descriptions are now updated to reflect the changes