aws / aws/aws-cdk

aws-route53: CrossAccountZoneDelegationRecord fails deployment when parentHostedZoneName contains a trailing dot

Open
#28,623 1 comment 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-route53 bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Currently deployments of stacks fail if they contain a `CrossAccountZoneDelegationRecord` where the parent hosted zone name has a trailing dot (supplied in construct property `parentHostedZoneName`).

### Expected Behavior

Deployment is expected to work transparently, regardless of whether or not there is a trailing dot. This is expected since:
- Route53 already treats these two names as synonymous - the trailing dot is stripped under *Hosted zone name* in the AWS console, but present elsewhere, e.g. `aws route53 list-hosted-zones | jq '.HostedZones[].Name'`. The `ListHostedZonesByName` action also appears to handle both.
- Zone names with the trailing dot is arguably the *more correct* representation, since this is what appears in the generated `AWS::Route53::HostedZone` CFN by default when using PublicHostedZone/PrivateHostedZone constructs, and is used by the Route53 API.

### Current Behavior

CloudFormation deployment of the parent stack fails - in *Events*:

Status: `CREATE_FAILED`

Status reason: `Received response status [FAILED] from custom resource. Message returned: Error: Expected one hosted zone to match the given name but found 0 at A (/var/task/index.js:1:1613) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async s (/var/task/index.js:1:1272) at async Runtime.handler (/var/task/__entrypoint__.js:1:932)`

### Reproduction Steps

1. Follow instructions to create setup for *Cross Account Zone Delegation* - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_route53-readme.html#cross-account-zone-delegation
2. Modify `parentHostedZoneName` to contain a trailing dot.

### Possible Solution

Change filter in custom resource handler to not append the trailing dot automatically: https://github.com/aws/aws-cdk/blob/3656a4c06539e68a2eda3d3b98f5d92e956dc37d/packages/%40aws-cdk/custom-resource-handlers/lib/aws-route53/cross-account-zone-delegation-handler/index.ts#L78-L83

The preceding [`ListHostedZonesByName` call](https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByName.html#API_ListHostedZonesByName_RequestParameters
) likely does not need to be changed (both formats should yield the same response), however this should be confirmed.

### Additional Information/Context

_No response_

### CDK CLI Version

2

### Framework Version

_No response_

### Node.js Version

18.18.2

### OS

Amazon Linux 2

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Read packages/@aws-cdk/custom-resource-handlers/lib/aws-route53/cross-account-zone-delegation-handler/index.ts around lines 78-83, then inspect the preceding ListHostedZonesByName call. Confirm how names with and without a trailing dot are returned, and verify that deployment succeeds for either form without changing the expected single-zone match behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.