You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Route53 allows enabling DNSSEC keys on registered domain, and also enable DNSSEC signing per hosted zone. It would be amazing if this was configurable through Ansible as well.
It would probably be a combination of using kms module to create the key and then applying it to the zone.
kms_key: seems to be missing the action GetPublicKey to configure this correctly
route53_zone: allow DNSSEC to be enabled, referring to a key
the final step would be to enable the trust chain somehow, which is configured at the "Registered domains" section within AWS. I dont think there is currently an Ansible module for that.
Issue Type
Feature Idea
Component Name
route53_zone, route53, kms_key
Additional Information
The feature would combine multiple modules to fully enable DNSSEC signing for a domain.
Step 1)
Configure an KMS key using the kms_key module, ending up with the required policy (principal/serviceaccount masked):
@hakbailey Personally I never touched these modules so would have no idea what the best way is to implement these features. Not sure if I'm the right person to make a PR on this request.
Summary
Route53 allows enabling DNSSEC keys on registered domain, and also enable DNSSEC signing per hosted zone. It would be amazing if this was configurable through Ansible as well.
It would probably be a combination of using kms module to create the key and then applying it to the zone.
kms_key: seems to be missing the action GetPublicKey to configure this correctly
route53_zone: allow DNSSEC to be enabled, referring to a key
the final step would be to enable the trust chain somehow, which is configured at the "Registered domains" section within AWS. I dont think there is currently an Ansible module for that.
Issue Type
Feature Idea
Component Name
route53_zone, route53, kms_key
Additional Information
The feature would combine multiple modules to fully enable DNSSEC signing for a domain.
Step 1)
Configure an KMS key using the kms_key module, ending up with the required policy (principal/serviceaccount masked):
Step 2)
Configure the hosted zone, enabling DNSSEC signing:
Step 3)
Establish a chain of trust for the domain (i dont think there is a module currently available that does anything related to TLD requests)
Code of Conduct
The text was updated successfully, but these errors were encountered: