From 91a6bf9b747ea19715bb1d339f8d934b15b158b5 Mon Sep 17 00:00:00 2001 From: Irving Popovetsky Date: Tue, 3 Nov 2026 14:21:28 -0800 Subject: [PATCH] Enable DNSSEC stage 2: DS record at the registrar Signing ran 53 hours (longer than the 48h apex NS TTL) and all checked RRsets validated against KSK tag 23956. The DS record was added by apply; provider 5.100.0 failed on read-back, so it was imported with ignore_changes on signing_attributes. terraform plan reports No changes. Co-Authored-By: Claude Opus 5.5 --- terraform/dns_operationcode_org_security.tf | 41 ++++++++++++--------- 1 file changed, 24 insertions(+), 17 deletions(-) diff --git a/terraform/dns_operationcode_org_security.tf b/terraform/dns_operationcode_org_security.tf index d783ee1..4b5b8d8 100644 --- a/terraform/dns_operationcode_org_security.tf +++ b/terraform/dns_operationcode_org_security.tf @@ -98,25 +98,32 @@ resource "aws_route53_hosted_zone_dnssec" "operationcode" { depends_on = [aws_route53_key_signing_key.operationcode] } -# Stage 2: DS record at the registrar (Route53 Domains, us-east-1). Keep commented out until: -# 1. signing is verified: `aws route53 get-dnssec --hosted-zone-id ` shows SIGNING and the -# KSK ACTIVE, and `dig +dnssec operationcode.org SOA` returns RRSIG records -# 2. the max TTL in the zone has passed since signing started (NS: 172800s = 48h; other records: 3600s) -# Rollback order: remove the DS record first, wait for the DS TTL at the .org parent (and the +# Stage 2: DS record at the registrar (Route53 Domains, us-east-1). This completes the DNSSEC +# chain of trust from .org to this zone. Enabled 2026-11-03, after signing ran for 53 hours +# (longer than the 48h apex NS TTL) and every checked RRset validated against KSK tag 23956. +# Rollback order: remove this DS record first, wait for the DS TTL at the .org parent (and the # registrar change) to pass, then disable signing (aws_route53_hosted_zone_dnssec signing_status = "NOT_SIGNING"). -# Disabling signing while the DS record is live makes the domain fail resolution for validating resolvers. -# -# resource "aws_route53domains_delegation_signer_record" "operationcode" { -# provider = aws.us_east_1 -# domain_name = "operationcode.org" -# -# signing_attributes { -# algorithm = aws_route53_key_signing_key.operationcode.signing_algorithm_type -# flags = aws_route53_key_signing_key.operationcode.flag -# public_key = aws_route53_key_signing_key.operationcode.public_key -# } -# } +# Disabling signing or deleting the KSK while the DS record is live makes the domain fail +# resolution for validating resolvers. +resource "aws_route53domains_delegation_signer_record" "operationcode" { + provider = aws.us_east_1 + domain_name = "operationcode.org" + + signing_attributes { + algorithm = aws_route53_key_signing_key.operationcode.signing_algorithm_type + flags = aws_route53_key_signing_key.operationcode.flag + public_key = aws_route53_key_signing_key.operationcode.public_key + } + # The provider does not read signing_attributes back (import and refresh leave them empty), + # which would force a destroy/recreate of the live DS record. A KSK rotation needs a new DS + # record anyway, so ignore drift here and replace the DS deliberately during a rotation. + lifecycle { + ignore_changes = [signing_attributes] + } + + depends_on = [aws_route53_hosted_zone_dnssec.operationcode] +} # ====================================================================== # Query logging # ======================================================================