Skip to content

NPT-959 Use appropriate Root zone for certifcate records #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
soji-kainos-nhs-temp merged 1 commit into from
Mar 19, 2026
+6 −4
Merged

NPT-959 Use appropriate Root zone for certifcate records #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion infrastructure/stacks/account_wide/acm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ resource "aws_acm_certificate" "custom_domain_api_cert" {
}

resource "aws_route53_record" "cert_validation" {
provider = aws.mgmt
for_each = var.environment == "mgmt" ? {} : {
for dvo in aws_acm_certificate.custom_domain_api_cert[0].domain_validation_options : dvo.domain_name => {
name = dvo.resource_record_name
Expand All @@ -21,7 +22,7 @@ resource "aws_route53_record" "cert_validation" {
}
}

zone_id = aws_route53_zone.environment_zone[0].zone_id
zone_id = data.aws_route53_zone.root_zone[0].zone_id
name = each.value.name
type = each.value.type
ttl = var.cert_validation_record_ttl
Expand Down
4 changes: 2 additions & 2 deletions infrastructure/stacks/github_runner/account_github_runner_security.policy.json.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@
"route53:DisassociateVPCFromHostedZone",
"route53:GetHealthCheck",
"route53:GetHostedZone",
"route53:ListHostedZones",
"route53:ListResourceRecordSets",
"route53:ListTagsForResource"
],
"Resource": [
"arn:aws:acm:${aws_region}:${account_id}:certificate/*",
"arn:aws:acm:*:${account_id}:certificate/*",
"arn:aws:route53:::hostedzone/*"
]
},
Expand Down
3 changes: 2 additions & 1 deletion infrastructure/stacks/github_runner/app_github_runner_security.policy.json.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"Action": [
"acm:AddTagsToCertificate",
"acm:ListTagsForCertificate",
"acm:RequestCertificate",
"route53:AssociateVPCWithHostedZone",
"route53:ChangeResourceRecordSets",
"route53:ChangeTagsForResource",
Expand All @@ -16,7 +17,7 @@
"route53:ListTagsForResource"
],
"Resource": [
"arn:aws:acm:${aws_region}:${account_id}:certificate/*",
"arn:aws:acm:*:${account_id}:certificate/*",
"arn:aws:route53:::hostedzone/*"
]
},
Expand Down
Loading