Certificate verification route53 record is not deleted, even when the certificate is removed
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the bug
I created a new certificate by using the certificate validation from DNS. Like this,
const myZone = route53.HostedZone.fromLookup(this, "myZone", {
domainName: `${myHostedZone}`,
});
const myInstanceCert = new cm.Certificate(this, "myInstanceCert", {
domainName: "*." + `${myHostedZone}`,
validation: cm.CertificateValidation.fromDns(myDnsZone),
});
The value of myHostedZone was set to "rmsis.net". Now, if I change the value of myHostedZone to "rmsis.optimizoryapps.com", a new certificate is created and the old one is deleted. This process also creates a new DNS record in the new hosted-zone to verify the new certificate. But the certificate verification DNS record in the old hosted-zone is not deleted in the process.
### Expected Behavior
Ideally, there should be a complete cleanup if the certificate itself is deleted. All related resources must cleaned up. That means, the route53 record, which was created to validate the certificate, should be deleted.
### Current Behavior
Currently the stale record in route53 is still present. Even after deleting the certificate.
### Reproduction Steps
1. Code in the description should be used
2. Set the value of myHostedZone to something that you have rights into
3. Deploy
4. Again change the value of myHostedZone
5. Deploy
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.81.0
### Framework Version
_No response_
### Node.js Version
18.16.0
### OS
Debian
### Language
Typescript
### Language Version
5.0.4
### Other information
_No response_
Contributor guide
Research direction
Start by tracing the certificate DNS validation and Route 53 cleanup behavior described in the reproduction, then reproduce it by changing the hosted-zone domain and deploying again. Done means replacing the certificate also removes the stale validation record from the old hosted zone while creating the record for the new certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100