### Terragrunt Example: Managing Multiple S3 Buckets

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/README.md

A practical example using Terragrunt to manage multiple S3 buckets via the Route53 module wrappers. It showcases setting default configurations and specific item configurations for different buckets.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers?ref=master"
}

inputs = {
  defaults = {
    force_destroy = true

    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}
```

--------------------------------

### Terragrunt Example: Managing Multiple S3 Buckets

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/resolver-endpoint/README.md

An example Terragrunt configuration for managing multiple S3 buckets using the resolver-endpoint wrapper. It shows how to define default bucket properties and individual bucket configurations.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers/resolver-endpoint"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers/resolver-endpoint?ref=master"
}

inputs = {
  defaults = {
    force_destroy = true

    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}
```

--------------------------------

### Bulk Create Hosted Zones with Shared Defaults

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

This example demonstrates creating multiple Route53 hosted zones with shared tagging defaults using a wrapper module. Each item in `items` can override the `defaults`.

```hcl
module "zones" {
  source = "terraform-aws-modules/route53/aws//wrappers"

  defaults = {
    tags = {
      ManagedBy   = "Terraform"
      Environment = "production"
    }
  }

  items = {
    public_zone = {
      name    = "example.com"
      comment = "Primary public zone"
      records = {
        www = {
          type    = "A"
          ttl     = 300
          records = ["1.2.3.4"]
        }
      }
    }
    internal_zone = {
      name = "internal.example.com"
      vpc = {
        main = {
          vpc_id     = "vpc-0abc12345678"
          vpc_region = "eu-west-1"
        }
      }
    }
  }
}
```

--------------------------------

### Terragrunt Example: Managing Multiple S3 Buckets with Resolver Firewall Rule Group Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/resolver-firewall-rule-group/README.md

This Terragrunt configuration shows an example of managing multiple S3 buckets using the resolver-firewall-rule-group wrapper. It highlights default settings like force_destroy and various policy attachments, along with specific bucket configurations.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers/resolver-firewall-rule-group"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers/resolver-firewall-rule-group?ref=master"
}

inputs = {
  defaults = {
    force_destroy = true

    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}
```

--------------------------------

### Example Usage of Resolver Firewall Rule Group Module

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/modules/resolver-firewall-rule-group/README.md

Demonstrates how to configure the resolver firewall rule group module with various rule types, including blocking, blocking with override, and allowing domains. It also shows how to apply tags to the resources.

```hcl
module "resolver_firewall_rule_group" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-firewall-rule-group"

  name   = "example"

  rules = {
    block = {
      name           = "blockit"
      priority       = 110
      action         = "BLOCK"
      block_response = "NODATA"
      domains        = ["google.com."]

      tags = { rule = true }
    }
    block_override = {
      priority                = 120
      action                  = "BLOCK"
      block_response          = "OVERRIDE"
      block_override_dns_type = "CNAME"
      block_override_domain   = "example.com"
      block_override_ttl      = 1
      domains                 = ["microsoft.com."]
    }
    # Unfortunately, a data source does not exist yet to pull managed domain lists
    # but users can stil copy the managed domain list ID and paste it into the config
    # block_managed_domain_list = {
    #   priority       = 135
    #   action         = "BLOCK"
    #   block_response = "NODATA"
    #   domain_list_id =  data.aws_route53_resolver_firewall_domain_list.this.id # => "rslvr-fdl-fad18de921a64bfa"
    # }
    allow = {
      priority = 130
      action   = "ALLOW"
      domains  = ["amazon.com.", "amazonaws.com."]
    }
  }

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}
```

--------------------------------

### Create Route53 Delegation Set and Zone

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/modules/delegation-sets/README.md

This example shows how to create a Route53 delegation set and then associate it with a new Route53 zone. The `delegation_set_id` output from the delegation set module is used as an input for the zone module.

```hcl
module "delegation_sets" {
  source  = "terraform-aws-modules/route53/aws//modules/delegation-sets"

  delegation_sets = {
    "myapp1" = {
      reference_name = "myapp1"
    }
  }

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}

module "zones" {
  source  = "terraform-aws-modules/route53/aws"

  name = "myapp1.com"

  delegation_set_id = module.delegation_sets.route53_delegation_set_id["myapp1"]

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}
```

--------------------------------

### Create Outbound Resolver Endpoint with Rules

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/modules/resolver-endpoint/README.md

Set up an outbound Route53 Resolver Endpoint, including DNS forwarding rules for specific domains. This example demonstrates configuring both FORWARD and SYSTEM rule types.

```hcl
module "resolver_endpoint" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-endpoint"

  name = "example-inbound"
  direction = "OUTBOUND"
  type      = "IPV4"
  protocols = ["Do53", "DoH"]

  ip_address = [
    {
      subnet_id = "subnet-abcde012"
    },
    {
      subnet_id = "subnet-bcde012a"
    }
  ]

  # Security group
  vpc_id = "vpc-1234556abcdef"
  security_group_ingress_rules = {
    one = {
      cidr_ipv4 = "10.0.0.0/20"
      description = "Allow inbound DNS queries from first subnet"
    }
    two = {
      cidr_ipv4 = "10.0.16.0/20"
      description = "Allow inbound DNS queries from second subnet"
    }
  }
  security_group_egress_rules = {
    one = {
      cidr_ipv4 = "10.0.0.0/20"
      description = "Allow outbound DNS responses to first subnet"
    }
    two = {
      cidr_ipv4 = "10.0.16.0/20"
      description = "Allow outbound DNS responses to second subnet"
    }
  }

  # Resolver Rule(s) & Association(s)
  rules = {
    ex-forward = {
      domain_name = "example.com."
      rule_type   = "FORWARD"
      target_ip = [{
        ip = "123.45.67.89"
      }]
      # Association
      vpc_id = "vpc-1234556abcdef"
    }
    ex-system = {
      domain_name = "system.com."
      rule_type   = "SYSTEM"
    }
  }

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}
```

--------------------------------

### Terraform State Move Block Example (ignore_vpc = false to true)

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/examples/cross-account/README.md

Alternatively, use a Terraform state block to manage the resource movement when changing `ignore_vpc` from false to true.

```hcl
moved {
  from = module.zone.aws_route53_zone.this[0]
  to   = module.zone.aws_route53_zone.ignore_vpc[0]
}
```

--------------------------------

### Terraform State Move Example (ignore_vpc = false to true)

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/examples/cross-account/README.md

Use this command to move Terraform state when changing the `ignore_vpc` variable from false to true, which switches from the `aws_route53_zone.this` resource to `aws_route53_zone.ignore_vpc`.

```bash
terraform state mv 'module.zone.aws_route53_zone.this[0]' 'module.zone.aws_route53_zone.ignore_vpc[0]'
```

--------------------------------

### Terraform State Move Block Example (ignore_vpc = true to false)

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/examples/cross-account/README.md

Alternatively, use a Terraform state block to manage the resource movement when changing `ignore_vpc` from true to false.

```hcl
moved {
  from = module.zone.aws_route53_zone.ignore_vpc[0]
  to   = module.zone.aws_route53_zone.this[0]
}
```

--------------------------------

### Terraform State Move Example (ignore_vpc = true to false)

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/examples/cross-account/README.md

Use this command to move Terraform state when changing the `ignore_vpc` variable from true to false, which switches from the `aws_route53_zone.ignore_vpc` resource to `aws_route53_zone.this`.

```bash
terraform state mv 'module.zone.aws_route53_zone.ignore_vpc[0]' 'module.zone.aws_route53_zone.this[0]'
```

--------------------------------

### Terragrunt Usage for Route53 Wrappers

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/README.md

Demonstrates how to configure Terragrunt to use the Route53 module wrappers. This setup allows managing multiple module instances from a single Terragrunt configuration file.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers?ref=master"
}

inputs = {
  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Create Route53 Resolver Outbound Endpoint with Rules

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Set up a Route53 Resolver outbound endpoint to forward VPC DNS queries for specific domains to on-premises resolvers. This example also defines resolver rules and their VPC associations inline.

```hcl
module "resolver_outbound" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-endpoint"

  name      = "corp-outbound"
  direction = "OUTBOUND"
  type      = "IPV4"
  protocols = ["Do53"]

  # Fixed IP addresses for the endpoint NICs
  ip_address = [
    { ip = "10.0.1.10", subnet_id = "subnet-aaa111" },
    { ip = "10.0.2.10", subnet_id = "subnet-bbb222" },
  ]

  vpc_id = "vpc-0abc12345678"
  security_group_ingress_rules = {
    vpc = { cidr_ipv4 = "10.0.0.0/8", description = "VPC DNS queries" }
  }
  security_group_egress_rules = {
    on_prem = { cidr_ipv4 = "192.168.0.0/16", description = "Forward to on-prem" }
  }

  # Resolver rules & associations
  rules = {
    forward_corp = {
      domain_name = "corp.example.com."
      rule_type   = "FORWARD"
      target_ip = [{
        ip       = "192.168.1.53"
        port     = 53
        protocol = "Do53"
      }]
      vpc_id = "vpc-0abc12345678"
    }
    system_override = {
      domain_name = "amazonaws.com."
      rule_type   = "SYSTEM"
      vpc_id      = "vpc-0abc12345678"
    }
  }

  tags = { Environment = "production" }
}

output "resolver_rules" { value = module.resolver_outbound.rules }
```

--------------------------------

### Configure Multivalue Answer Routing Policy for Route53 Records

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

This example configures a Multivalue Answer routing policy for Route53 records. It returns multiple healthy IP addresses per query for simple load distribution and requires a health check ID.

```hcl
module "zone_multivalue" {
  source = "terraform-aws-modules/route53/aws"

  name = "example.com"

  records = {
    server_a = {
      type                             = "A"
      ttl                              = 60
      records                          = ["10.0.0.1"]
      set_identifier                   = "server-a"
      multivalue_answer_routing_policy = true
      health_check_id                  = "hc-aaaabbbb-1111-2222-3333-444455556666"
    }
    server_b = {
      type                             = "A"
      ttl                              = 60
      records                          = ["10.0.0.2"]
      set_identifier                   = "server-b"
      multivalue_answer_routing_policy = true
      health_check_id                  = "hc-ccccdddd-5555-6666-7777-888899990000"
    }
  }
}
```

--------------------------------

### Terragrunt Example: Managing Multiple S3 Buckets

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/delegation-sets/README.md

This Terragrunt configuration manages multiple S3 buckets using the delegation sets wrapper. It sets default bucket configurations like `force_destroy` and `attach_elb_log_delivery_policy`, and defines specific bucket names and tags for individual items.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers/delegation-sets"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers/delegation-sets?ref=master"
}

inputs = {
  defaults = {
    force_destroy = true

    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}
```

--------------------------------

### Configure CIDR Routing Policy for Route53 Records

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

This example shows how to configure a CIDR routing policy for Route53 records. It routes DNS queries based on the originating resolver's IP CIDR block and requires a pre-created CIDR collection and location name.

```hcl
module "zone_cidr" {
  source = "terraform-aws-modules/route53/aws"

  name = "example.com"

  records = {
    cidr_eu = {
      type           = "A"
      ttl            = 60
      records        = ["10.1.0.10"]
      set_identifier = "eu-office"
      cidr_routing_policy = {
        collection_id = "a1b2c3d4-1234-5678-abcd-ef0123456789"
        location_name = "eu-office-subnet"
      }
    }
  }
}
```

--------------------------------

### Terraform Initialization and Execution

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/examples/cross-account/README.md

Standard Terraform commands to initialize the project, plan changes, and apply them to create the resources.

```bash
terraform init
terraform plan
terraform apply
```

--------------------------------

### Bulk Create Delegation Sets

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Use this snippet to bulk-create delegation sets using the Route53 wrapper module. It allows defining multiple delegation sets with shared defaults.

```hcl
# Bulk-create delegation sets
module "delegation_sets_bulk" {
  source = "terraform-aws-modules/route53/aws//wrappers/delegation-sets"

  defaults = {}

  items = {
    app1 = { delegation_sets = { app1 = { reference_name = "app1" } } }
    app2 = { delegation_sets = { app2 = { reference_name = "app2" } } }
  }
}
```

--------------------------------

### Create Public Hosted Zone with DNS Records

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Use this snippet to create a public Route53 hosted zone and populate it with various DNS record types, including A, AAAA, MX, CNAME, and records configured for weighted, failover, latency, and geolocation routing policies. Ensure correct alias targets and zone IDs are provided for alias records.

```hcl
module "zone_public" {
  source = "terraform-aws-modules/route53/aws"

  name    = "example.com"
  comment = "Public zone managed by Terraform"

  # A record – alias to CloudFront
  # AAAA record – dual-stack CloudFront
  # MX record – Google Workspace mail
  # Weighted CNAME – blue/green split
  # Failover – primary / secondary
  # Latency-based routing
  # Geolocation routing
  # Geoproximity routing (AWS region)
  # Geoproximity routing (coordinates)
  records = {
    cloudfront = {
      type = "A"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "Z2FDTNDATAQYW2"
      }
    }
    cloudfront_ipv6 = {
      name = "cloudfront"          # reuses same subdomain as above
      type = "AAAA"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "Z2FDTNDATAQYW2"
      }
    }
    mail = {
      full_name = "example.com"    # sets the exact FQDN (no zone appended)
      type      = "MX"
      ttl       = 3600
      records = [
        "1 aspmx.l.google.com",
        "5 alt1.aspmx.l.google.com",
      ]
    }
    blue = {
      name           = "api"
      type           = "CNAME"
      ttl            = 5
      records        = ["api-v1.example.com."]
      set_identifier = "api-primary"
      weighted_routing_policy = {
        weight = 90
      }
    }
    green = {
      name           = "api"
      type           = "CNAME"
      ttl            = 5
      records        = ["api-v2.example.com."]
      set_identifier = "api-secondary"
      weighted_routing_policy = {
        weight = 10
      }
    }
    failover_primary = {
      type            = "A"
      set_identifier  = "failover-primary"
      health_check_id = "d641c34c-a992-4edd-8a63-c540a4b18d0a"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "Z2FDTNDATAQYW2"
      }
      failover_routing_policy = {
        type = "PRIMARY"
      }
    }
    failover_secondary = {
      type           = "A"
      set_identifier = "failover-secondary"
      alias = {
        name    = "s3-website-eu-west-1.amazonaws.com"
        zone_id = "Z1BKCTXD74EZPE"
      }
      failover_routing_policy = {
        type = "SECONDARY"
      }
    }
    eu_latency = {
      type           = "A"
      set_identifier = "eu-west-1"
      alias = {
        name                   = "d3778kt32cqdww.cloudfront.net"
        zone_id                = "Z2FDTNDATAQYW2"
        evaluate_target_health = true
      }
      latency_routing_policy = {
        region = "eu-west-1"
      }
    }
    geo_eu = {
      type           = "CNAME"
      ttl            = 60
      records        = ["eu.backend.example.com."]
      set_identifier = "europe"
      geolocation_routing_policy = {
        continent = "EU"
      }
    }
    geo_us_east_1 = {
      type           = "CNAME"
      ttl            = 60
      records        = ["us-east-1.backend.example.com."]
      set_identifier = "us-east-1-region"
      geoproximity_routing_policy = {
        aws_region = "us-east-1"
        bias       = 0
      }
    }
    geo_nyc = {
      type           = "CNAME"
      ttl            = 60
      records        = ["nyc.backend.example.com."]
      set_identifier = "nyc"
      geoproximity_routing_policy = {
        coordinates = [{
          latitude  = "40.71"
          longitude = "-74.01"
        }]
      }
    }
  }

  tags = {
    Environment = "production"
    Project     = "my-app"
  }
}

```

--------------------------------

### Create Reusable Route53 Delegation Sets

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Use this module to create one or more reusable Route53 delegation sets. These sets consist of four name servers that can be shared across multiple hosted zones.

```hcl
module "delegation_sets" {
  source = "terraform-aws-modules/route53/aws//modules/delegation-sets"

  delegation_sets = {
    myapp = {
      reference_name = "myapp"
    }
    otherapp = {
      reference_name = "otherapp"
    }
  }

  tags = { Environment = "production" }
}

# Use the delegation set ID when creating a zone
module "zone_with_delegation" {
  source = "terraform-aws-modules/route53/aws"

  name              = "myapp.example.com"
  delegation_set_id = module.delegation_sets.route53_delegation_set_id["myapp"]

  tags = { Environment = "production" }
}

output "delegation_set_ids"          { value = module.delegation_sets.route53_delegation_set_id }
output "delegation_set_name_servers" { value = module.delegation_sets.route53_delegation_set_name_servers }
output "delegation_set_ref_names"    { value = module.delegation_sets.route53_delegation_set_reference_name }
```

--------------------------------

### Terraform Usage for Route53 Wrappers

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/README.md

Illustrates how to use the Route53 module wrappers directly within a Terraform configuration. This enables managing multiple module instances without duplicating `terragrunt.hcl` files.

```hcl
module "wrapper" {
  source = "terraform-aws-modules/route53/aws//wrappers"

  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Terraform Configuration for Delegation Sets Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/delegation-sets/README.md

This Terraform configuration demonstrates how to use the delegation sets wrapper module. It defines the module source and input variables, including default tags and specific item configurations.

```hcl
module "wrapper" {
  source = "terraform-aws-modules/route53/aws//wrappers/delegation-sets"

  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Enable DNSSEC for Public Hosted Zone

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Enables DNSSEC for a public hosted zone, automatically creating a KMS key. An existing KMS key ARN can be provided via `dnssec_kms_key_arn` when `create_dnssec_kms_key = false`.

```hcl
module "zone_dnssec" {
  source = "terraform-aws-modules/route53/aws"

  name          = "secure.example.com"
  enable_dnssec = true

  # Optional: bring your own KMS key
  # create_dnssec_kms_key = false
  # dnssec_kms_key_arn    = "arn:aws:kms:us-east-1:123456789012:key/mrk-abc123"

  # Optional: pin the KSK name (useful when importing existing DNSSEC)
  # dnssec_key_signing_key_name = "my-existing-ksk"

  dnssec_kms_key_aliases      = ["alias/route53-dnssec-secure-example"]
  dnssec_kms_key_description  = "KMS key for secure.example.com DNSSEC"
  dnssec_kms_key_tags         = { ManagedBy = "Terraform" }

  tags = { Environment = "production" }
}

output "ds_record"     { value = module.zone_dnssec.dnssec_signing_key_ds_record }
output "dnskey_record" { value = module.zone_dnssec.dnssec_signing_key_dnskey_record }
output "kms_key_arn"   { value = module.zone_dnssec.dnssec_kms_key_arn }
```

--------------------------------

### Create Public Route53 Hosted Zone

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/README.md

Use this module to create a public Route53 hosted zone with various record types including A, MX, CNAME, and Alias records. Supports different routing policies like geolocation, geoproximity, weighted, and failover.

```hcl
module "zone" {
  source = "terraform-aws-modules/route53/aws"

  name    = "terraform-aws-modules-example.com"
  comment = "Public zone for terraform-aws-modules example"

  records = {
    s3 = {
      name = "s3-bucket-z1bkctxd74ezpe.terraform-aws-modules-example.com"
      type = "A"
      alias = {
        name    = "s3-website-eu-west-1.amazonaws.com"
        zone_id = "Z1BKCTXD74EZPE"
      }
    }
    mail = {
      full_name = "terraform-aws-modules-example.com"
      type = "MX"
      ttl  = 3600
      records = [
        "1 aspmx.l.google.com",
        "5 alt1.aspmx.l.google.com",
        "5 alt2.aspmx.l.google.com",
        "10 alt3.aspmx.l.google.com",
        "10 alt4.aspmx.l.google.com",
      ]
    }
    geo = {
      type           = "CNAME"
      ttl            = 5
      records        = ["europe.test.example.com."]
      set_identifier = "europe"
      geolocation_routing_policy = {
        continent = "EU"
      }
    }
    geoproximity-aws-region = {
      type           = "CNAME"
      ttl            = 5
      records        = ["us-east-1.test.example.com."]
      set_identifier = "us-east-1-region"
      geoproximity_routing_policy = {
        aws_region = "us-east-1"
        bias       = 0
      }
    }
    geoproximity-coordinates = {
      type           = "CNAME"
      ttl            = 5
      records        = ["nyc.test.example.com."]
      set_identifier = "nyc"
      geoproximity_routing_policy = {
        coordinates = [{
          latitude  = "40.71"
          longitude = "-74.01"
        }]
      }
    }
    cloudfront_ipv4 = {
      name = "cloudfront"
      type = "A"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "EF3T6981F7M1"
      }
    }
    cloudfront_ipv6 = {
      name = "cloudfront"
      type = "AAAA"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "EF3T6981F7M1"
      }
    }
    blue = {
      name           = "test"
      type           = "CNAME"
      ttl            = 5
      records        = ["test.example.com."]
      set_identifier = "test-primary"
      weighted_routing_policy = {
        weight = 90
      }
    }
    green = {
      name           = "test"
      type           = "CNAME"
      ttl            = 5
      records        = ["test2.example.com."]
      set_identifier = "test-secondary"
      weighted_routing_policy = {
        weight = 10
      }
    }
    failover-primary = {
      type            = "A"
      set_identifier  = "failover-primary"
      health_check_id = "d641c34c-a992-4edd-8a63-c540a4b18d0a"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "EF3T6981F7M1"
      }
      failover_routing_policy = {
        type = "PRIMARY"
      }
    }
    failover-secondary = {
      type           = "A"
      set_identifier = "failover-secondary"
      alias = {
        name    = "s3-website-eu-west-1.amazonaws.com"
        zone_id = "Z1BKCTXD74EZPE"
      }
      failover_routing_policy = {
        type = "SECONDARY"
      }
    }
    latency-test = {
      type           = "A"
      set_identifier = "latency-test"
      alias = {
        name    = "d3778kt32cqdww.cloudfront.net"
        zone_id = "EF3T6981F7M1"
        evaluate_target_health = true
      }
      latency_routing_policy = {
        region = "eu-west-1"
      }
    }
  }

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}
```

--------------------------------

### Configure Private Zone with VPC Association Authorization

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/README.md

Use this configuration to set up a private Route53 zone and authorize VPC associations from external accounts. The `ignore_vpc` variable is crucial for managing state when switching between VPC association modes.

```hcl
module "zone" {
  source = "terraform-aws-modules/route53/aws"

  name    = "terraform-aws-modules-example.com"
  comment = "Private zone for terraform-aws-modules example"

  # Ignore VPC after creation to avoid disruptive diff with associations
  ignore_vpc = true
  vpc = {
    default = {
      vpc_id     = "vpc-1234556abcdef"
      vpc_region = "eu-west-1"
    }
  }

  vpc_association_authorizations = {
    external = {
      vpc_id     = "vpc-987564fedcba"
      vpc_region = "eu-west-1"
    }
    external_region = {
      vpc_id     = "vpc-1a2b3c4d56e7f8"
      vpc_region = "us-east-1"
    }
  }

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}
```

--------------------------------

### Terragrunt Configuration for Delegation Sets Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/delegation-sets/README.md

Use this configuration in your `terragrunt.hcl` file to manage delegation sets. It specifies the module source and input variables, including default values and specific items.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers/delegation-sets"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers/delegation-sets?ref=master"
}

inputs = {
  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Outputs for Public Hosted Zone

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Outputs available after creating a public Route53 hosted zone.

```hcl
output "zone_id"           { value = module.zone_public.id }
output "zone_arn"          { value = module.zone_public.arn }
output "name_servers"      { value = module.zone_public.name_servers }
output "primary_ns"        { value = module.zone_public.primary_name_server }
output "all_records"       { value = module.zone_public.records }
```

--------------------------------

### Create Private Hosted Zone with VPC Association

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Creates a private Route53 hosted zone and associates it with multiple VPCs. Records can be defined within this zone.

```hcl
module "zone_private" {
  source = "terraform-aws-modules/route53/aws"

  name    = "internal.example.com"
  comment = "Internal private zone"

  vpc = {
    primary = {
      vpc_id     = "vpc-0abc12345678"
      vpc_region = "eu-west-1"
    }
    secondary = {
      vpc_id     = "vpc-0def98765432"
      vpc_region = "eu-west-1"
    }
  }

  records = {
    api = {
      type    = "A"
      ttl     = 300
      records = ["10.0.1.50"]
    }
    db = {
      type    = "CNAME"
      ttl     = 300
      records = ["my-rds.cluster-xyz.eu-west-1.rds.amazonaws.com"]
    }
  }

  tags = { Environment = "production" }
}
```

--------------------------------

### Create Inbound Resolver Endpoint

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/modules/resolver-endpoint/README.md

Configure an inbound Route53 Resolver Endpoint for DNS queries. Specify IP addresses, VPC, and security group rules for ingress and egress traffic.

```hcl
module "resolver_endpoint" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-endpoint"

  name = "example-inbound"
  direction = "INBOUND"
  type      = "IPV4"
  protocols = ["Do53", "DoH"]

  ip_address = [
    {
      subnet_id = "subnet-abcde012"
    },
    {
      subnet_id = "subnet-bcde012a"
    }
  ]

  # Security group
  vpc_id = "vpc-1234556abcdef"
  security_group_ingress_rules = {
    one = {
      cidr_ipv4 = "10.0.0.0/20"
      description = "Allow inbound DNS queries from first subnet"
    }
    two = {
      cidr_ipv4 = "10.0.16.0/20"
      description = "Allow inbound DNS queries from second subnet"
    }
  }
  security_group_egress_rules = {
    one = {
      cidr_ipv4 = "10.0.0.0/20"
      description = "Allow outbound DNS responses to first subnet"
    }
    two = {
      cidr_ipv4 = "10.0.16.0/20"
      description = "Allow outbound DNS responses to second subnet"
    }
  }

  tags = {
    Environment = "example"
    Project     = "terraform-aws-route53"
  }
}
```

--------------------------------

### Conditionally Disable Route53 Module Resources

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Set `create = false` to prevent the creation of resources for the main Route53 module. This is useful for disabling the module without removing it from your configuration.

```hcl
module "zone_disabled" {
  source = "terraform-aws-modules/route53/aws"
  create = false  # no resources are created
}
```

--------------------------------

### Terraform Configuration for Resolver Endpoint Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/resolver-endpoint/README.md

This Terraform configuration demonstrates how to use the resolver-endpoint wrapper module. It defines the module source and input variables for managing resolver endpoints.

```hcl
module "wrapper" {
  source = "terraform-aws-modules/route53/aws//wrappers/resolver-endpoint"

  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Conditionally Disable Route53 Resolver Firewall Rule Group Sub-module

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Set `create = false` to prevent the creation of resources for the Route53 Resolver Firewall Rule Group sub-module. This enables conditional deployment of DNS-layer security features.

```hcl
module "firewall_disabled" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-firewall-rule-group"
  create = false
}
```

--------------------------------

### Terraform Configuration for Resolver Firewall Rule Group Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/resolver-firewall-rule-group/README.md

This Terraform configuration demonstrates how to use the wrapper module to manage Route53 Resolver Firewall Rule Groups. It includes default settings and specific configurations for multiple items.

```hcl
module "wrapper" {
  source = "terraform-aws-modules/route53/aws//wrappers/resolver-firewall-rule-group"

  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Create Route53 Resolver Inbound Endpoint

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Configure a Route53 Resolver inbound endpoint to forward DNS queries from on-premises networks or other VPCs into a specific VPC. A security group with necessary ingress and egress rules is automatically created.

```hcl
module "resolver_inbound" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-endpoint"

  name      = "corp-inbound"
  direction = "INBOUND"
  type      = "IPV4"           # IPV4 | IPV6 | DUALSTACK
  protocols = ["Do53", "DoH"] # Do53 | DoH | DoH-FIPS

  ip_address = [
    { subnet_id = "subnet-aaa111" },
    { subnet_id = "subnet-bbb222" },
  ]

  # Security group (auto-created)
  vpc_id = "vpc-0abc12345678"
  security_group_ingress_rules = {
    on_prem = {
      cidr_ipv4   = "192.168.0.0/16"
      description = "DNS queries from on-premises"
    }
  }
  security_group_egress_rules = {
    vpc = {
      cidr_ipv4   = "10.0.0.0/8"
      description = "DNS responses to VPC"
    }
  }

  tags = { Environment = "production" }
}

output "endpoint_id"          { value = module.resolver_inbound.id }
output "endpoint_arn"         { value = module.resolver_inbound.arn }
output "endpoint_ip_addresses"{ value = module.resolver_inbound.ip_addresses }
output "security_group_id"    { value = module.resolver_inbound.security_group_id }
```

--------------------------------

### Terraform State Move Command for ignore_vpc Change

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/README.md

Execute these bash commands to migrate Terraform state when changing the `ignore_vpc` variable for a Route53 zone resource. This is necessary to prevent unintended resource destruction and recreation.

```bash
terraform state mv 'module.zone.aws_route53_zone.this[0]' 'module.zone.aws_route53_zone.ignore_vpc[0]'
```

```bash
terraform state mv 'module.zone.aws_route53_zone.ignore_vpc[0]' 'module.zone.aws_route53_zone.this[0]'
```

--------------------------------

### Cross-Account VPC Association for Private Hosted Zone

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Creates a private hosted zone in one account and authorizes VPCs in other accounts to associate with it. `ignore_vpc = true` prevents diffs from external `aws_route53_zone_association` resources.

```hcl
# Zone-owner account
module "zone" {
  source = "terraform-aws-modules/route53/aws"

  name       = "shared.internal"
  comment    = "Shared private zone"
  ignore_vpc = true   # ignore VPC changes after creation

  vpc = {
    owner_vpc = {
      vpc_id     = "vpc-owner111111"
      vpc_region = "eu-west-1"
    }
  }

  # Authorise VPCs in other accounts to associate
  vpc_association_authorizations = {
    account_b_vpc = {
      vpc_id     = "vpc-external222222"
      vpc_region = "eu-west-1"
    }
    account_c_us = {
      vpc_id     = "vpc-external333333"
      vpc_region = "us-east-1"
    }
  }

  tags = { Environment = "shared" }
}

# VPC-owner account (separate provider / assume_role)
resource "aws_route53_zone_association" "account_b" {
  provider = aws.account_b

  zone_id    = module.zone.id
  vpc_id     = "vpc-external222222"
  vpc_region = "eu-west-1"
}

# State move required if toggling ignore_vpc after initial creation:
# terraform state mv 'module.zone.aws_route53_zone.this[0]' 'module.zone.aws_route53_zone.ignore_vpc[0]'
```

--------------------------------

### Create Public Hosted Zone with Accelerated Recovery

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Enables Route 53 Accelerated Recovery on a public hosted zone, providing a 60-minute RTO for DNS record management if the AWS us-east-1 Region becomes unavailable.

```hcl
module "zone_resilient" {
  source = "terraform-aws-modules/route53/aws"

  name                        = "resilient.example.com"
  enable_accelerated_recovery = true   # public zones only

  tags = { Environment = "production" }
}
```

--------------------------------

### Create Route53 Resolver DNS Firewall Rule Group

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Use this snippet to create a Route53 Resolver DNS Firewall rule group. It allows defining multiple rules with different actions and domain lists, and can be shared across accounts via AWS RAM.

```hcl
module "dns_firewall" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-firewall-rule-group"

  name = "corp-dns-firewall"

  rules = {
    block_malware = {
      name           = "block-malware"
      priority       = 100
      action         = "BLOCK"
      block_response = "NODATA"
      domains        = ["malware.example.com.", "phishing.bad.com."]
    }
    block_and_redirect = {
      priority                = 110
      action                  = "BLOCK"
      block_response          = "OVERRIDE"
      block_override_dns_type = "CNAME"
      block_override_domain   = "safe-redirect.example.com."
      block_override_ttl      = 30
      domains                 = ["ads.tracker.com."]
    }
    allow_trusted = {
      priority = 120
      action   = "ALLOW"
      domains  = ["amazon.com.", "amazonaws.com.", "example.com."]
    }
  }

  # Share the rule group via AWS RAM (optional)
  ram_resource_associations = {
    shared_services = {
      resource_share_arn = "arn:aws:ram:eu-west-1:123456789012:resource-share/abc123"
    }
  }

  tags = { Environment = "production" }
}

output "firewall_rule_group_id"  { value = module.dns_firewall.id }
output "firewall_rule_group_arn" { value = module.dns_firewall.arn }
output "firewall_domain_lists"   { value = module.dns_firewall.domain_lists }
output "firewall_rules"          { value = module.dns_firewall.rules }
output "share_status"            { value = module.dns_firewall.share_status }
```

--------------------------------

### Conditionally Disable Route53 Resolver Endpoint Sub-module

Source: https://context7.com/terraform-aws-modules/terraform-aws-route53/llms.txt

Set `create = false` to prevent the creation of resources for the Route53 Resolver Endpoint sub-module. This allows for conditional deployment of this specific functionality.

```hcl
module "resolver_disabled" {
  source = "terraform-aws-modules/route53/aws//modules/resolver-endpoint"
  create = false
}
```

--------------------------------

### Terragrunt Configuration for Resolver Endpoint Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-route53/blob/master/wrappers/resolver-endpoint/README.md

Use this Terragrunt configuration to manage multiple instances of the resolver-endpoint module. It specifies the module source and input variables.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/route53/aws//wrappers/resolver-endpoint"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-route53.git//wrappers/resolver-endpoint?ref=master"
}

inputs = {
  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```