aws / aws/aws-cdk

Certificate verification route53 record is not deleted, even when the certificate is removed

Open
#25,797 5 comments 10 reactions 0 assignees View on GitHub
@aws-cdk/aws-route53 bug needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

I created a new certificate by using the certificate validation from DNS. Like this,

const myZone = route53.HostedZone.fromLookup(this, "myZone", {
domainName: `${myHostedZone}`,
});

const myInstanceCert = new cm.Certificate(this, "myInstanceCert", {
domainName: "*." + `${myHostedZone}`,
validation: cm.CertificateValidation.fromDns(myDnsZone),
});

The value of myHostedZone was set to "rmsis.net". Now, if I change the value of myHostedZone to "rmsis.optimizoryapps.com", a new certificate is created and the old one is deleted. This process also creates a new DNS record in the new hosted-zone to verify the new certificate. But the certificate verification DNS record in the old hosted-zone is not deleted in the process.

### Expected Behavior

Ideally, there should be a complete cleanup if the certificate itself is deleted. All related resources must cleaned up. That means, the route53 record, which was created to validate the certificate, should be deleted.

### Current Behavior

Currently the stale record in route53 is still present. Even after deleting the certificate.

### Reproduction Steps

1. Code in the description should be used
2. Set the value of myHostedZone to something that you have rights into
3. Deploy
4. Again change the value of myHostedZone
5. Deploy

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.81.0

### Framework Version

_No response_

### Node.js Version

18.16.0

### OS

Debian

### Language

Typescript

### Language Version

5.0.4

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the certificate DNS validation and Route 53 cleanup behavior described in the reproduction, then reproduce it by changing the hosted-zone domain and deploying again. Done means replacing the certificate also removes the stale validation record from the old hosted zone while creating the record for the new certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.