{"id":15692739,"url":"https://github.com/lgallard/terraform-aws-route53-resolver-rules","last_synced_at":"2025-12-28T06:34:39.967Z","repository":{"id":48990958,"uuid":"243331040","full_name":"lgallard/terraform-aws-route53-resolver-rules","owner":"lgallard","description":"Terraform module to create AWS Route53 Resolver Rules.","archived":false,"fork":false,"pushed_at":"2025-03-28T01:03:06.000Z","size":39,"stargazers_count":10,"open_issues_count":3,"forks_count":13,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-07-06T00:29:49.226Z","etag":null,"topics":["aws","resolver","route53","route53-resolver","terraform-module","terrafrom"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lgallard.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-02-26T18:06:33.000Z","updated_at":"2025-04-27T05:55:04.000Z","dependencies_parsed_at":"2025-05-07T23:47:20.335Z","dependency_job_id":"2db45c76-d5bc-4209-b070-ae64a98efe4b","html_url":"https://github.com/lgallard/terraform-aws-route53-resolver-rules","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/lgallard/terraform-aws-route53-resolver-rules","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-route53-resolver-rules","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-route53-resolver-rules/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-route53-resolver-rules/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-route53-resolver-rules/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lgallard","download_url":"https://codeload.github.com/lgallard/terraform-aws-route53-resolver-rules/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-route53-resolver-rules/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264795839,"owners_count":23665241,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","resolver","route53","route53-resolver","terraform-module","terrafrom"],"created_at":"2024-10-03T18:39:37.932Z","updated_at":"2025-12-28T06:34:39.952Z","avatar_url":"https://github.com/lgallard.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Terraform](https://lgallardo.com/images/terraform.jpg)\n# terraform-aws-route53-resolver-rules\n\nTerraform module to create [AWS Route53 Resolver Rules](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html/).\n\n## Usage\n\nBefore you start to forward queries, you must create  Resolver outbound endpoints in the connected VPCs. These endpoints provide a path for inbound or outbound queries. To accomplish this you can create the endpoints using the [aws_route53_resolver_endpoint](https://www.terraform.io/docs/providers/aws/r/route53_resolver_endpoint.html) resource or use a module like the [terraform-aws-route53-endpoint](https://github.com/rhythmictech/terraform-aws-route53-endpoint)\n\nCheck the [examples](examples/) folder for the **simple** and the **complete** snippets.\n\n### Example (complete)\n\nThis example creates two rules in a outbound endpoint, using all the parameter expected for building the rules:\n\n```\n# Outbound endpoint using the rhythmictech/terraform-aws-route53-endpoint module\nmodule \"r53-outbound\" {\n  source            = \"git::https://github.com/rhythmictech/terraform-aws-route53-endpoint?ref=v0.3.1\"\n  direction         = \"outbound\"\n  allowed_resolvers = [\"192.168.0.0/24\"]\n  vpc_id            = \"vpc-0fffff0123456789\"\n  ip_addresses      = [\n    {\n      ip        = \"172.30.1.10\"\n      subnet_id = \"subnet-abcd123456789aaaa\"\n    },\n    {\n      ip        = \"172.30.2.10\"\n      subnet_id = \"subnet-abcd123456789bbbb\"\n    }\n  ]\n}\n\n# AWS Route 53 Resolver rules\nmodule \"r53-resolver-rules\" {\n  source               = \"git::https://github.com/lgallard/terraform-aws-route53-resolver-rules.git?ref=0.2.0\"\n  resolver_endpoint_id = module.r53-outbound.endpoint_id\n\n  rules = [\n    { rule_name   = \"r53r-rule-1\"\n      domain_name = \"bar.foo.\"\n      ram_name    = \"ram-r53r-1\"\n      vpc_ids     = [\"vpc-0fffff0123456789\"]\n      ips         = [\"192.168.10.10\", \"192.168.10.11:54\"]\n      principals  = [\"123456789101\", \"101987654321\"]\n    },\n    {\n      rule_name   = \"r53r-rule-2\"\n      domain_name = \"example.com.\"\n      ram_name    = \"ram-r53r-2\"\n      vpc_ids     = [\"vpc-0fffff0123456789\"]\n      ips         = [\"192.168.10.10\", \"192.168.10.11:54\"]\n      principals  = [\"123456789101\", \"101987654321\"]\n    }\n  ]\n}\n\n```\n\n**Note**: You can define IP and ports using the *IP:PORT* syntax, as shown above.\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| resolver\\_endpoint\\_id | The ID of the outbound resolver endpoint that you want to use to route DNS queries to the IP addresses that you specify using target\\_ip. | `string` | `null` | yes |\n| rules | List of rules | `list` | `[]` | no |\n| tags | Map of tags to apply to supported resources | `map(string)` | `{}` | no |\n\nEach rule accept the following parameters:\n\n### Rules\n\n| Name | Description | Type | Default | Required |\n|------|-------------|:----:|:-----:|:-----:|\n| domain\\_name | Domain name to forward requests for | string | `null` | yes |\n| ips | List of IPs and ports to forward DNS requests to. Use *IP:PORT* syntax, or just the IP | list(string) | `[]`| yes |\n| principals | List of account IDs to share the resolver rule with | list(string) | `[]` | no |\n| ram\\_name | RAM share name | string | r53-`domain_name`-rule | no |\n| resolver\\_endpoint\\_id | Resolver endpoint id | string | `null` | yes |\n| rule\\_name | Route53 resolver rule name | string | `domain_name`-rule | no |\n| tags | Map of tags to apply to supported resources | map(string) | `{}` | no |\n| vpc\\_ids | List of VPC ids to associate to the rule | list(string) | `[]` | yes |\n\n## Testing\n\nThis module includes comprehensive tests using [Terratest](https://github.com/gruntwork-io/terratest). The test suite covers:\n\n- Basic resolver rule creation and validation\n- Multiple resolver rules with different configurations\n- VPC association functionality\n- RAM resource sharing for cross-account scenarios\n- Custom DNS port configurations\n- Resource tagging\n- Input validation and edge cases\n\n### Running Tests\n\nTo run the tests locally:\n\n```bash\ncd test\ngo mod tidy\ngo test -v -timeout 30m\n```\n\nFor more details on the testing framework and how to run specific tests, see the [test documentation](test/README.md).\n\n### Test Coverage\n\n- ✅ Basic resolver rule creation\n- ✅ Multiple resolver rules\n- ✅ VPC associations\n- ✅ RAM resource sharing\n- ✅ Custom DNS ports\n- ✅ Resource tagging\n- ✅ Input validation and error cases\n- ✅ Module outputs\n- ✅ Edge cases and boundary conditions\n\n## Development\n\n### Pre-commit Hooks\n\nThis repository uses pre-commit hooks to ensure code quality and DNS/networking-specific validation. The hooks include:\n\n- **Terraform formatting** (`terraform fmt`)\n- **Terraform validation** (`terraform validate`)\n- **Terraform documentation** (auto-generated)\n- **TFLint** for advanced Terraform linting\n- **TFSec** for security scanning\n- **DNS domain validation** (ensures FQDN format with trailing dots)\n- **VPC ID format validation**\n- **IP address format validation**\n- **YAML/JSON validation**\n- **Secret detection**\n- **File formatting** (trailing whitespace, end-of-file fixes)\n\n#### Setup\n\n1. **Install pre-commit**:\n   ```bash\n   pip install pre-commit\n   ```\n\n2. **Install the hooks**:\n   ```bash\n   pre-commit install\n   ```\n\n3. **Run hooks manually** (optional):\n   ```bash\n   # Run on all files\n   pre-commit run --all-files\n   \n   # Run on specific files\n   pre-commit run --files main.tf variables.tf\n   ```\n\n#### DNS-Specific Validations\n\nThe pre-commit hooks include custom validations for Route53 resolver rules:\n\n- **Domain Names**: Must be fully qualified (end with a dot), e.g., `\"example.com.\"`\n- **VPC IDs**: Must follow AWS format, e.g., `\"vpc-12345678\"`\n- **IP Addresses**: Must use valid IPv4 format, optionally with ports, e.g., `\"192.168.1.1:53\"`\n\n#### Configuration Files\n\nThe pre-commit setup includes several configuration files:\n\n- `.pre-commit-config.yaml` - Main pre-commit configuration\n- `.tflint.hcl` - TFLint rules for Terraform linting\n- `.tfsec.yml` - TFSec security scanning configuration\n- `.terraform-docs.yml` - Terraform documentation generation\n- `.secrets.baseline` - Baseline for secret detection\n\nThese hooks run automatically on every commit and help maintain code quality, security, and DNS/networking best practices.\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n\n\n## Usage\n\nBefore you start to forward queries, you must create Resolver outbound endpoints in the connected VPCs. These endpoints provide a path for inbound or outbound queries. To accomplish this you can create the endpoints using the [aws_route53_resolver_endpoint](https://www.terraform.io/docs/providers/aws/r/route53_resolver_endpoint.html) resource or use a module like the [terraform-aws-route53-endpoint](https://github.com/rhythmictech/terraform-aws-route53-endpoint)\n\nCheck the [examples](examples/) folder for the **simple** and the **complete** snippets.\n\n### Example (complete)\n\nThis example creates two rules in a outbound endpoint, using all the parameter expected for building the rules:\n\n```hcl\n# Outbound endpoint using the rhythmictech/terraform-aws-route53-endpoint module\nmodule \"r53-outbound\" {\n  source            = \"git::https://github.com/rhythmictech/terraform-aws-route53-endpoint?ref=v0.3.1\"\n  direction         = \"outbound\"\n  allowed_resolvers = [\"192.168.0.0/24\"]\n  vpc_id            = \"vpc-0fffff0123456789\"\n  ip_addresses      = [\n    {\n      ip        = \"172.30.1.10\"\n      subnet_id = \"subnet-abcd123456789aaaa\"\n    },\n    {\n      ip        = \"172.30.2.10\"\n      subnet_id = \"subnet-abcd123456789bbbb\"\n    }\n  ]\n}\n\n# AWS Route 53 Resolver rules\nmodule \"r53-resolver-rules\" {\n  source               = \"git::https://github.com/lgallard/terraform-aws-route53-resolver-rules.git?ref=0.2.0\"\n  resolver_endpoint_id = module.r53-outbound.endpoint_id\n\n  rules = [\n    { rule_name   = \"r53r-rule-1\"\n      domain_name = \"bar.foo.\"\n      ram_name    = \"ram-r53r-1\"\n      vpc_ids     = [\"vpc-0fffff0123456789\"]\n      ips         = [\"192.168.10.10\", \"192.168.10.11:54\"]\n      principals  = [\"123456789101\", \"101987654321\"]\n    },\n    {\n      rule_name   = \"r53r-rule-2\"\n      domain_name = \"example.com.\"\n      ram_name    = \"ram-r53r-2\"\n      vpc_ids     = [\"vpc-0fffff0123456789\"]\n      ips         = [\"192.168.10.10\", \"192.168.10.11:54\"]\n      principals  = [\"123456789101\", \"101987654321\"]\n    }\n  ]\n}\n```\n\n**Note**: You can define IP and ports using the *IP:PORT* syntax, as shown above.\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 4.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 6.6.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_ram_principal_association.endpoint_ram_principal](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource |\n| [aws_ram_resource_association.endpoint_ram_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource |\n| [aws_ram_resource_share.endpoint_share](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource |\n| [aws_route53_resolver_rule.r](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_rule) | resource |\n| [aws_route53_resolver_rule_association.ra](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_rule_association) | resource |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_resolver_endpoint_id\"\u003e\u003c/a\u003e [resolver\\_endpoint\\_id](#input\\_resolver\\_endpoint\\_id) | The ID of the outbound resolver endpoint that you want to use to route DNS queries to the IP addresses specified in target\\_ip | `string` | `null` | no |\n| \u003ca name=\"input_rules\"\u003e\u003c/a\u003e [rules](#input\\_rules) | List of rules | `list(any)` | `[]` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Map of tags to apply to supported resources. Each tag is a key-value pair stored as a map of strings. | `map(string)` | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_resolver_rules\"\u003e\u003c/a\u003e [resolver\\_rules](#output\\_resolver\\_rules) | Resolver rules |\n\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flgallard%2Fterraform-aws-route53-resolver-rules","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flgallard%2Fterraform-aws-route53-resolver-rules","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flgallard%2Fterraform-aws-route53-resolver-rules/lists"}