Resolver Endpoints, Forwarding, Query Logs and DNSSEC

aws-route53-resolver

Route 53 Resolver endpoints, forwarding rules, query logging and DNSSEC validation - the pieces that carry DNS across a VPC boundary. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

An endpoint is only as available as its IP addresses. Each address lives in one subnet, so an endpoint with addresses in a single availability zone stops resolving when that zone does - and DNS failing is every application failing at once. AWS requires two addresses; this module requires them in two different subnets, which is the part the API does not check.

Query logging is the only record of what a host asked for. It cannot be reconstructed afterwards: a query that was not logged when it happened is gone. That is why "what did that instance talk to before we noticed?" so often has no answer, and why query_logging_enabled is an output rather than an assumption.

DNSSEC validation turns a silent lie into a loud failure. A zone whose signatures do not verify returns SERVFAIL instead of resolving to whatever the answer claimed to be. That is the point - and it does mean somebody else's broken signing becomes your outage, so the variable says so.

The SYSTEM rule type is the one people miss: it carries no targets and exists to carve an exception out of a FORWARD rule, sending one subdomain back to AWS's own resolver rather than the forwarder that covers its parent. The example shows the pair.

Preconditions refuse a FORWARD rule with no outbound endpoint, and a FORWARD rule with no targets - both of which the API accepts or reports late.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.