Route 53 - 将 A 类型更改为 AAAA

Question

我有适用于type=A 记录DNS 的terraform 脚本。所以当我执行这个时：

data "aws_acm_certificate" "this" {
  domain = "*.${var.CERTIFICATE_DOMAIN}"
}

resource "aws_security_group" "this" {
  name        = "${var.SERVICE}-${var.ENV}-${var.REGION}-allow_all"
  description = "Allow all inbound traffic"
  vpc_id      = "${data.aws_vpc.this.id}"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

data "aws_subnet_ids" "this" {
  vpc_id = "${data.aws_vpc.this.id}"

  tags {
    Service = "external"
  }
}

data "aws_security_groups" "ecs" {
  tags {
    Environment = "${var.VPC_ENV}"
    Region      = "${var.REGION}"
  }

  filter {
    name   = "vpc-id"
    values = ["${data.aws_vpc.this.id}"]
  }

  filter {
    name   = "group-name"
    values = ["${var.ENV}-api-internal-ecs-host*-sg"]
  }
}

resource "aws_security_group_rule" "lb2ecs" {
  from_port                = 32768
  to_port                  = 65535
  protocol                 = "tcp"
  security_group_id        = "${data.aws_security_groups.ecs.ids[0]}"
  source_security_group_id = "${aws_security_group.this.id}"
  type                     = "ingress"
}

resource "aws_alb" "https" {
  name               = "${var.SERVICE}-${var.ENV}-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = ["${aws_security_group.this.id}"]
  subnets            = ["${data.aws_subnet_ids.this.ids}"]
}

data "aws_route53_zone" "this" {
  name         = "${var.CERTIFICATE_DOMAIN}."
  private_zone = false
}

resource "aws_route53_record" "www" {
  zone_id = "${data.aws_route53_zone.this.zone_id}"
  name    = "${var.SERVICE}-${var.ENV}-${var.REGION}.${var.CERTIFICATE_DOMAIN}"
  type    = "A"

  alias {
    name                   = "${aws_alb.https.dns_name}"
    zone_id                = "${aws_alb.https.zone_id}"
    evaluate_target_health = true
  }
}

resource "aws_alb_target_group" "https" {
  name     = "${var.SERVICE}-${var.ENV}-https"
  port     = 3000
  protocol = "HTTP"
  vpc_id   = "${data.aws_vpc.this.id}"

  health_check {
    path = "/health"
  }
}

resource "aws_alb_listener" "https" {
  load_balancer_arn = "${aws_alb.https.arn}"
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2015-05"
  certificate_arn   = "${data.aws_acm_certificate.this.arn}"

  default_action {
    type             = "forward"
    target_group_arn = "${aws_alb_target_group.https.arn}"
  }
}

它会正确创建新的 HTTPS 端点，我可以轻松地将服务放在它后面（通过将aws_alb_target_group.https 与 ECS 服务链接）

我需要添加 IPv6 支持，所以我在想 - 将 resource "aws_route53_record" "www" 中的 A 类型更改为 AAAA 怎么样。 terraform 执行良好，说明它已更改，在 Route 53 中我可以看到记录看起来与以前完全相同，但它具有 AAAA 类型，但服务不再可用。

在 Route 53 中，我可以看到 ALIAS 如下所示：someservice-test-alb-1395527311.eu-central-1.elb.amazonaws.com。我可以从公共互联网通过 HTTPS 访问该服务。然而，之前工作的“好”端点不再工作了。同样pinging URL 不再收到任何 IP。

我错过了什么吗？

Answer 1

AAAA 记录，您需要先启用支持 IPV6 的 VPC。默认情况下未启用。 完成后，您可以按照以下博客中的指南为 teraform 启用 IPV6。

https://medium.com/@mattias.holmlund/setting-up-ipv6-on-amazon-with-terraform-e14b3bfef577