Looks like SST/CDK is creating a bunch of CName re...
# ssta
Adrián Mouly
10/08/2021, 5:04 PMLooks like SST/CDK is creating a bunch of CName records on Route 53 for stage-subdomains, like, for each PR or developers’ stage.
Is there a way to clean this from CDK/SST?
t
thdxr
10/08/2021, 5:04 PMThose are created to verify the domain ownership for generating an SSL cert. I'm surprised it doesn't get deleted when the stack is deleted 😦
a
Adrián Mouly
10/08/2021, 5:05 PMYeah.
Adrián Mouly
10/08/2021, 5:05 PMAre yours cleaned?
t
thdxr
10/08/2021, 5:06 PMI'm not using custom domains anywhere but staging or prod but let me test this out
a
Adrián Mouly
10/08/2021, 5:07 PMOk cool, thank you for checking.
Adrián Mouly
10/08/2021, 5:11 PMThese cnames should be created and used only once right? once is verified, is never used again?
Adrián Mouly
10/08/2021, 5:12 PMOnce the custom domain is created I mean, no need to verify anything.
b
Blake E
10/08/2021, 5:50 PMyeah, r53 verification records don’t really get cleaned up in my experience, my primary zone is just flooded with them.
More recently I started created sub-domain zones, so at least it’s segregated and easier to audit by hand.
Blake E
10/08/2021, 5:51 PMso like
<http://mycompany.com|mycompany.com><http://us-east-1.mycompany.com|us-east-1.mycompany.com><http://team-name.mycompany.com|team-name.mycompany.com>a
Adrián Mouly
10/08/2021, 5:51 PMInteresting.
b
Blake E
10/08/2021, 5:51 PM(create a new zone with desired sub-domain, and then copy the NS record from sub-domain zone - and create a NS record in primary domain zone pointing to those name servers)
a
Adrián Mouly
10/08/2021, 5:52 PMI have one zone for each “environment”, which is also a different account, so not much worry… but still I hate having all that crap.
b
Blake E
10/08/2021, 5:52 PMyeah exactly, I don’t have a way to easily get rid of crap, but at least isolating makes me feel better lol
a
Adrián Mouly
10/08/2021, 5:52 PMYeah, is weird thought.
Adrián Mouly
10/08/2021, 5:52 PMIf this is intentional or just a bug.
b
Blake E
10/08/2021, 5:53 PMI think that a) verification records can be re-used (so after deleting cert, and if it comes back, verification re-uses)
Blake E
10/08/2021, 5:53 PMb) no idea if you can delete after it’s verified (I imagine yes, but haven’t tested)
a
Adrián Mouly
10/08/2021, 5:53 PMHum yeah, wish we can configure a policy somewhere.
b
Blake E
10/08/2021, 5:54 PMgiven AWS CLI/SDK capabilities - I imagine you could programmatically clear out these records, they are pretty easily identified (which was my thought if I really wanted to clear them out)
a
Adrián Mouly
10/08/2021, 5:55 PMYeah, but I’m using high level constructs from SST, so not that easy, haha.
Adrián Mouly
10/08/2021, 5:55 PMWell maybe I can do a cleanup function or something.
b
Blake E
10/08/2021, 5:59 PMthe newly offered Script construct would be good for this sort of thing
Blake E
10/08/2021, 5:59 PMaws-sdka
Adrián Mouly
10/08/2021, 5:59 PMInteresting.
b
Blake E
10/08/2021, 6:00 PMthe Script construct might be the most underrated part of SST - it’s a very common issue/limitation of Cloudformation (as compared to Terraform).
Cloudformation doesn’t easily let you interrogate deployed resources (let alone interact with them, like creating MySQL users/tables)
t
thdxr
10/08/2021, 6:02 PM^ I'm realizing this too
thdxr
10/08/2021, 6:02 PMcan rig up all non-aws services with it
a
Adrián Mouly
10/08/2021, 6:02 PMI didn’t realize this yet, but going to check it 😂 .
Adrián Mouly
10/13/2021, 8:08 PM@Frank do you have any comment on this?
f
Frank
10/13/2021, 10:42 PM
Hmm yeah… might be doable i think. If we can get the DNS validation record name, set that as
ParamsScriptonRemovea
Adrián Mouly
10/13/2021, 10:43 PMYeah maybe that’s the way.
f
Frank
10/13/2021, 10:43 PM
Oh, found this https://github.com/aws/aws-cdk/issues/3333
a
Adrián Mouly
10/13/2021, 10:43 PMI mean, I was expecting to be removed automatically.
Adrián Mouly
10/13/2021, 10:43 PM😮
Adrián Mouly
10/13/2021, 10:43 PM😮 😮 😮
Adrián Mouly
10/13/2021, 10:44 PM2019 🤦♂️