Allow Route53 DNSSEC Signing

[rvgate]

Summary

Route53 allows enabling DNSSEC keys on registered domain, and also enable DNSSEC signing per hosted zone. It would be amazing if this was configurable through Ansible as well.

It would probably be a combination of using kms module to create the key and then applying it to the zone.

kms_key: seems to be missing the action GetPublicKey to configure this correctly
route53_zone: allow DNSSEC to be enabled, referring to a key

the final step would be to enable the trust chain somehow, which is configured at the "Registered domains" section within AWS. I dont think there is currently an Ansible module for that.

Issue Type

Feature Idea

Component Name

route53_zone, route53, kms_key

Additional Information

The feature would combine multiple modules to fully enable DNSSEC signing for a domain.

Step 1)
Configure an KMS key using the kms_key module, ending up with the required policy (principal/serviceaccount masked):

{
    "Version": "2012-10-17",
    "Id": "dnssec-policy",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXX:YYY"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow Route 53 DNSSEC Service",
            "Effect": "Allow",
            "Principal": {
                "Service": "dnssec-route53.amazonaws.com"
            },
            "Action": [
                "kms:DescribeKey",
                "kms:GetPublicKey",
                "kms:Sign"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "XXX"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:route53:::hostedzone/*"
                }
            }
        },
        {
            "Sid": "Allow Route 53 DNSSEC to CreateGrant",
            "Effect": "Allow",
            "Principal": {
                "Service": "dnssec-route53.amazonaws.com"
            },
            "Action": "kms:CreateGrant",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}

Step 2)
Configure the hosted zone, enabling DNSSEC signing:

- name: create hosted zone
  amazon.aws.route53_zone:
    access_key: "{{ aws.access_key_id }}"
    aws_secret_access_key: "{{ aws.secret_access_key }}"
    zone: mydomain.com
    dnssec:
      enabled: yes
      ksk_name: "{{ ksk.name }}"
      signing_key: "{{ kms.arn }}"

Step 3)
Establish a chain of trust for the domain (i dont think there is a module currently available that does anything related to TLD requests)

- name: update chain
  amazon.aws.??????:
    access_key: "{{ aws.access_key_id }}"
    aws_secret_access_key: "{{ aws.secret_access_key }}"
    domain: mydomain.com
    dnssec_keys:
        - tag: 12345
          key_type:  "{{ kms.type }}"
          algorithm: "{{ kms.algorithm }}"
          public_key: "{{ kms.public_key }}"

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[hakbailey]

@rvgate Thanks for the feature idea! Is this something you'd be willing to open a pull request for?

[rvgate]

@hakbailey Personally I never touched these modules so would have no idea what the best way is to implement these features. Not sure if I'm the right person to make a PR on this request.

[hakbailey]

@rvgate No problem, thanks for letting us know. We can add this to our backlog.