hosted_zones

Creates, updates, deletes, gets or lists a hosted_zones resource.

Overview

Name	hosted_zones
Type	Resource
Id	aws.route53.hosted_zones

Fields

The following fields are returned by SELECT queries:

get_hosted_zone

Name	Datatype	Description
caller_reference	string	The value that you specified for CallerReference when you created the hosted zone.
config	string	A complex type that includes the Comment and PrivateZone elements. If you omitted the HostedZoneConfig and Comment elements from the request, the Config and Comment elements don't appear in the response.
features	string	The features configuration for the hosted zone, including accelerated recovery settings and status information.
id	string	The ID that Amazon Route 53 assigned to the hosted zone when you created it.
linked_service	string	If the hosted zone was created by another service, the service that created the hosted zone. When a hosted zone is created by another service, you can't edit or delete it using Route 53.
name	string	The name of the domain. For public hosted zones, this is the name that you have registered with your DNS registrar. For information about how to specify characters other than a-z, 0-9, and - (hyphen) and how to specify internationalized domain names, see CreateHostedZone.
resource_record_set_count	integer	The number of resource record sets in the hosted zone.

list_hosted_zones

Name	Datatype	Description
caller_reference	string	The value that you specified for CallerReference when you created the hosted zone.
config	string	A complex type that includes the Comment and PrivateZone elements. If you omitted the HostedZoneConfig and Comment elements from the request, the Config and Comment elements don't appear in the response.
features	string	The features configuration for the hosted zone, including accelerated recovery settings and status information.
id	string	The ID that Amazon Route 53 assigned to the hosted zone when you created it.
linked_service	string	If the hosted zone was created by another service, the service that created the hosted zone. When a hosted zone is created by another service, you can't edit or delete it using Route 53.
name	string	The name of the domain. For public hosted zones, this is the name that you have registered with your DNS registrar. For information about how to specify characters other than a-z, 0-9, and - (hyphen) and how to specify internationalized domain names, see CreateHostedZone.
resource_record_set_count	integer	The number of resource record sets in the hosted zone.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_hosted_zone	select	id, region		Gets information about a specified hosted zone including the four name servers assigned to the hosted zone. returns the VPCs associated with the specified hosted zone and does not reflect the VPC associations by Route 53 Profiles. To get the associations to a Profile, call the ListProfileAssociations API.
list_hosted_zones	select	region	marker, maxitems, delegationsetid, hostedzonetype	Retrieves a list of the public and private hosted zones that are associated with the current Amazon Web Services account. The response includes a HostedZones child element for each hosted zone. Amazon Route 53 returns a maximum of 100 items in each response. If you have a lot of hosted zones, you can use the maxitems parameter to list them in groups of up to 100.
create_key_signing_key	insert	region, CallerReference, HostedZoneId, KeyManagementServiceArn		Creates a new key-signing key (KSK) associated with a hosted zone. You can only have two KSKs per hosted zone.
create_hosted_zone	insert	region, CallerReference		Creates a new public or private hosted zone. You create records in a public hosted zone to define how you want to route traffic on the internet for a domain, such as example.com, and its subdomains (apex.example.com, acme.example.com). You create records in a private hosted zone to define how you want to route traffic for a domain and its subdomains within one or more Amazon Virtual Private Clouds (Amazon VPCs). You can't convert a public hosted zone to a private hosted zone or vice versa. Instead, you must create a new hosted zone with the same name and create new resource record sets. For more information about charges for hosted zones, see Amazon Route 53 Pricing. Note the following: You can't create a hosted zone for a top-level domain (TLD) such as .com. For public hosted zones, Route 53 automatically creates a default SOA record and four NS records for the zone. For more information about SOA and NS records, see NS and SOA Records that Route 53 Creates for a Hosted Zone in the Amazon Route 53 Developer Guide. If you want to use the same name servers for multiple public hosted zones, you can optionally associate a reusable delegation set with the hosted zone. See the DelegationSetId element. If your domain is registered with a registrar other than Route 53, you must update the name servers with your registrar to make Route 53 the DNS service for the domain. For more information, see Migrating DNS Service for an Existing Domain to Amazon Route 53 in the Amazon Route 53 Developer Guide. When you submit a CreateHostedZone request, the initial status of the hosted zone is PENDING. For public hosted zones, this means that the NS and SOA records are not yet available on all Route 53 DNS servers. When the NS and SOA records are available, the status of the zone changes to INSYNC. The CreateHostedZone request requires the caller to have an ec2:DescribeVpcs permission. When creating private hosted zones, the Amazon VPC must belong to the same partition where the hosted zone is created. A partition is a group of Amazon Web Services Regions. Each Amazon Web Services account is scoped to one partition. The following are the supported partitions: aws - Amazon Web Services Regions aws-cn - China Regions aws-us-gov - Amazon Web Services GovCloud (US) Region For more information, see Access Management in the Amazon Web Services General Reference.
associate_vpc_with_hosted_zone	update	id, region		Associates an Amazon VPC with a private hosted zone. To perform the association, the VPC and the private hosted zone must already exist. You can't convert a public hosted zone into a private hosted zone. If you want to associate a VPC that was created by using one Amazon Web Services account with a private hosted zone that was created by using a different account, the Amazon Web Services account that created the private hosted zone must first submit a CreateVPCAssociationAuthorization request. Then the account that created the VPC must submit an AssociateVPCWithHostedZone request. When granting access, the hosted zone and the Amazon VPC must belong to the same partition. A partition is a group of Amazon Web Services Regions. Each Amazon Web Services account is scoped to one partition. The following are the supported partitions: aws - Amazon Web Services Regions aws-cn - China Regions aws-us-gov - Amazon Web Services GovCloud (US) Region For more information, see Access Management in the Amazon Web Services General Reference.
delete_key_signing_key	delete	hosted_zone_id, name, region		Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate it. The KSK must be deactivated before you can delete it regardless of whether the hosted zone is enabled for DNSSEC signing. You can use DeactivateKeySigningKey to deactivate the key before you delete it. Use GetDNSSEC to verify that the KSK is in an INACTIVE status.
delete_hosted_zone	delete	id, region		Deletes a hosted zone. If the hosted zone was created by another service, such as Cloud Map, see Deleting Public Hosted Zones That Were Created by Another Service in the Amazon Route 53 Developer Guide for information about how to delete it. (The process is the same for public and private hosted zones that were created by another service.) If you want to keep your domain registration but you want to stop routing internet traffic to your website or web application, we recommend that you delete resource record sets in the hosted zone instead of deleting the hosted zone. If you delete a hosted zone, you can't undelete it. You must create a new hosted zone and update the name servers for your domain registration, which can require up to 48 hours to take effect. (If you delegated responsibility for a subdomain to a hosted zone and you delete the child hosted zone, you must update the name servers in the parent hosted zone.) In addition, if you delete a hosted zone, someone could hijack the domain and route traffic to their own resources using your domain name. If you want to avoid the monthly charge for the hosted zone, you can transfer DNS service for the domain to a free DNS service. When you transfer DNS service, you have to update the name servers for the domain registration. If the domain is registered with Route 53, see UpdateDomainNameservers for information about how to replace Route 53 name servers with name servers for the new DNS service. If the domain is registered with another registrar, use the method provided by the registrar to update name servers for the domain registration. For more information, perform an internet search on "free DNS service." You can delete a hosted zone only if it contains only the default SOA and NS records and has DNSSEC signing disabled. If the hosted zone contains other records or has DNSSEC enabled, you must delete the records and disable DNSSEC before deletion. Attempting to delete a hosted zone with additional records or DNSSEC enabled returns a HostedZoneNotEmpty error. For information about deleting records, see ChangeResourceRecordSets. To verify that the hosted zone has been deleted, do one of the following: Use the GetHostedZone action to request information about the hosted zone. Use the ListHostedZones action to get a list of the hosted zones associated with the current Amazon Web Services account.
activate_key_signing_key	exec	hosted_zone_id, name, region		Activates a key-signing key (KSK) so that it can be used for signing by DNSSEC. This operation changes the KSK status to ACTIVE.
deactivate_key_signing_key	exec	hosted_zone_id, name, region		Deactivates a key-signing key (KSK) so that it will not be used for signing by DNSSEC. This operation changes the KSK status to INACTIVE.
update_hosted_zone_comment	exec	id, region		Updates the comment for a specified hosted zone.
disable_hosted_zone_dnssec	exec	id, region		Disables DNSSEC signing in a specific hosted zone. This action does not deactivate any key-signing keys (KSKs) that are active in the hosted zone.
disassociate_vpc_from_hosted_zone	exec	id, region		Disassociates an Amazon Virtual Private Cloud (Amazon VPC) from an Amazon Route 53 private hosted zone. Note the following: You can't disassociate the last Amazon VPC from a private hosted zone. You can't convert a private hosted zone into a public hosted zone. You can submit a DisassociateVPCFromHostedZone request using either the account that created the hosted zone or the account that created the Amazon VPC. Some services, such as Cloud Map and Amazon Elastic File System (Amazon EFS) automatically create hosted zones and associate VPCs with the hosted zones. A service can create a hosted zone using your account or using its own account. You can disassociate a VPC from a hosted zone only if the service created the hosted zone using your account. When you run DisassociateVPCFromHostedZone, if the hosted zone has a value for OwningAccount, you can use DisassociateVPCFromHostedZone. If the hosted zone has a value for OwningService, you can't use DisassociateVPCFromHostedZone. When revoking access, the hosted zone and the Amazon VPC must belong to the same partition. A partition is a group of Amazon Web Services Regions. Each Amazon Web Services account is scoped to one partition. The following are the supported partitions: aws - Amazon Web Services Regions aws-cn - China Regions aws-us-gov - Amazon Web Services GovCloud (US) Region For more information, see Access Management in the Amazon Web Services General Reference.
enable_hosted_zone_dnssec	exec	id, region		Enables DNSSEC signing in a specific hosted zone.
update_hosted_zone_features	exec	id, region		Updates the features configuration for a hosted zone. This operation allows you to enable or disable specific features for your hosted zone, such as accelerated recovery. Accelerated recovery enables you to update DNS records in your public hosted zone even when the us-east-1 region is unavailable.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
hosted_zone_id	string	A unique string used to identify a hosted zone.
id	string	The ID of the hosted zone for which you want to update features. This is the unique identifier for your hosted zone.
name	string	A string used to identify a key-signing key (KSK).
region	string	AWS region (default: us-east-1)
delegationsetid	string	If you're using reusable delegation sets and you want to list all of the hosted zones that are associated with a reusable delegation set, specify the ID of that reusable delegation set.
hostedzonetype	string	(Optional) Specifies if the hosted zone is private.
marker	string	If the value of IsTruncated in the previous response was true, you have more hosted zones. To get more hosted zones, submit another ListHostedZones request. For the value of marker, specify the value of NextMarker from the previous response, which is the ID of the first hosted zone that Amazon Route 53 will return if you submit another request. If the value of IsTruncated in the previous response was false, there are no more hosted zones to get.
maxitems	string	(Optional) The maximum number of hosted zones that you want Amazon Route 53 to return. If you have more than maxitems hosted zones, the value of IsTruncated in the response is true, and the value of NextMarker is the hosted zone ID of the first hosted zone that Route 53 will return if you submit another request.

SELECT examples

get_hosted_zone

Gets information about a specified hosted zone including the four name servers assigned to the hosted zone. returns the VPCs associated with the specified hosted zone and does not reflect the VPC associations by Route 53 Profiles. To get the associations to a Profile, call the ListProfileAssociations API.

SELECT
caller_reference,
config,
features,
id,
linked_service,
name,
resource_record_set_count
FROM aws.route53.hosted_zones
WHERE id = '{{ id }}' -- required
AND region = '{{ region }}' -- required
;

list_hosted_zones

Retrieves a list of the public and private hosted zones that are associated with the current Amazon Web Services account. The response includes a HostedZones child element for each hosted zone. Amazon Route 53 returns a maximum of 100 items in each response. If you have a lot of hosted zones, you can use the maxitems parameter to list them in groups of up to 100.

SELECT
caller_reference,
config,
features,
id,
linked_service,
name,
resource_record_set_count
FROM aws.route53.hosted_zones
WHERE region = '{{ region }}' -- required
AND marker = '{{ marker }}'
AND maxitems = '{{ maxitems }}'
AND delegationsetid = '{{ delegationsetid }}'
AND hostedzonetype = '{{ hostedzonetype }}'
;

INSERT examples

create_key_signing_key

Creates a new key-signing key (KSK) associated with a hosted zone. You can only have two KSKs per hosted zone.

INSERT INTO aws.route53.hosted_zones (
CallerReference,
HostedZoneId,
KeyManagementServiceArn,
Name,
Status,
region
)
SELECT 
'{{ CallerReference }}' /* required */,
'{{ HostedZoneId }}' /* required */,
'{{ KeyManagementServiceArn }}' /* required */,
'{{ Name }}',
'{{ Status }}',
'{{ region }}'
RETURNING
created_date,
dnskey_record,
ds_record,
digest_algorithm_mnemonic,
digest_algorithm_type,
digest_value,
flag,
key_tag,
kms_arn,
last_modified_date,
name,
public_key,
signing_algorithm_mnemonic,
signing_algorithm_type,
status,
status_message
;

create_hosted_zone

Creates a new public or private hosted zone. You create records in a public hosted zone to define how you want to route traffic on the internet for a domain, such as example.com, and its subdomains (apex.example.com, acme.example.com). You create records in a private hosted zone to define how you want to route traffic for a domain and its subdomains within one or more Amazon Virtual Private Clouds (Amazon VPCs). You can't convert a public hosted zone to a private hosted zone or vice versa. Instead, you must create a new hosted zone with the same name and create new resource record sets. For more information about charges for hosted zones, see Amazon Route 53 Pricing. Note the following: You can't create a hosted zone for a top-level domain (TLD) such as .com. For public hosted zones, Route 53 automatically creates a default SOA record and four NS records for the zone. For more information about SOA and NS records, see NS and SOA Records that Route 53 Creates for a Hosted Zone in the Amazon Route 53 Developer Guide. If you want to use the same name servers for multiple public hosted zones, you can optionally associate a reusable delegation set with the hosted zone. See the DelegationSetId element. If your domain is registered with a registrar other than Route 53, you must update the name servers with your registrar to make Route 53 the DNS service for the domain. For more information, see Migrating DNS Service for an Existing Domain to Amazon Route 53 in the Amazon Route 53 Developer Guide. When you submit a CreateHostedZone request, the initial status of the hosted zone is PENDING. For public hosted zones, this means that the NS and SOA records are not yet available on all Route 53 DNS servers. When the NS and SOA records are available, the status of the zone changes to INSYNC. The CreateHostedZone request requires the caller to have an ec2:DescribeVpcs permission. When creating private hosted zones, the Amazon VPC must belong to the same partition where the hosted zone is created. A partition is a group of Amazon Web Services Regions. Each Amazon Web Services account is scoped to one partition. The following are the supported partitions: aws - Amazon Web Services Regions aws-cn - China Regions aws-us-gov - Amazon Web Services GovCloud (US) Region For more information, see Access Management in the Amazon Web Services General Reference.

INSERT INTO aws.route53.hosted_zones (
Name,
VPC,
CallerReference,
HostedZoneConfig,
DelegationSetId,
region
)
SELECT 
'{{ Name }}',
'{{ VPC }}',
'{{ CallerReference }}' /* required */,
'{{ HostedZoneConfig }}',
'{{ DelegationSetId }}',
'{{ region }}'
RETURNING
caller_reference,
config,
features,
id,
linked_service,
name,
resource_record_set_count
;

Manifest

# Description fields are for documentation purposes
- name: hosted_zones
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the hosted_zones resource.
  - name: CallerReference
    value: "{{ CallerReference }}"
  - name: HostedZoneId
    value: "{{ HostedZoneId }}"
  - name: KeyManagementServiceArn
    value: "{{ KeyManagementServiceArn }}"
  - name: Name
    value: "{{ Name }}"
  - name: Status
    value: "{{ Status }}"
  - name: VPC
    description: |
      (Private hosted zones only) A complex type that contains information about an Amazon VPC. If you associate a private hosted zone with an Amazon VPC when you make a CreateHostedZone request, the following parameters are also required.
    value:
      VPCRegion: "{{ VPCRegion }}"
      VPCId: "{{ VPCId }}"
  - name: HostedZoneConfig
    description: |
      A complex type that contains an optional comment about your hosted zone. If you don't want to specify a comment, omit both the HostedZoneConfig and Comment elements.
    value:
      Comment: "{{ Comment }}"
      PrivateZone: {{ PrivateZone }}
  - name: DelegationSetId
    value: "{{ DelegationSetId }}"

UPDATE examples

associate_vpc_with_hosted_zone

Associates an Amazon VPC with a private hosted zone. To perform the association, the VPC and the private hosted zone must already exist. You can't convert a public hosted zone into a private hosted zone. If you want to associate a VPC that was created by using one Amazon Web Services account with a private hosted zone that was created by using a different account, the Amazon Web Services account that created the private hosted zone must first submit a CreateVPCAssociationAuthorization request. Then the account that created the VPC must submit an AssociateVPCWithHostedZone request. When granting access, the hosted zone and the Amazon VPC must belong to the same partition. A partition is a group of Amazon Web Services Regions. Each Amazon Web Services account is scoped to one partition. The following are the supported partitions: aws - Amazon Web Services Regions aws-cn - China Regions aws-us-gov - Amazon Web Services GovCloud (US) Region For more information, see Access Management in the Amazon Web Services General Reference.

UPDATE aws.route53.hosted_zones
SET 
VPC = '{{ VPC }}',
Comment = '{{ Comment }}'
WHERE 
id = '{{ id }}' --required
AND region = '{{ region }}' --required
RETURNING
comment,
id,
status,
submitted_at;

DELETE examples

delete_key_signing_key

Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate it. The KSK must be deactivated before you can delete it regardless of whether the hosted zone is enabled for DNSSEC signing. You can use DeactivateKeySigningKey to deactivate the key before you delete it. Use GetDNSSEC to verify that the KSK is in an INACTIVE status.

DELETE FROM aws.route53.hosted_zones
WHERE hosted_zone_id = '{{ hosted_zone_id }}' --required
AND name = '{{ name }}' --required
AND region = '{{ region }}' --required
;

delete_hosted_zone

Deletes a hosted zone. If the hosted zone was created by another service, such as Cloud Map, see Deleting Public Hosted Zones That Were Created by Another Service in the Amazon Route 53 Developer Guide for information about how to delete it. (The process is the same for public and private hosted zones that were created by another service.) If you want to keep your domain registration but you want to stop routing internet traffic to your website or web application, we recommend that you delete resource record sets in the hosted zone instead of deleting the hosted zone. If you delete a hosted zone, you can't undelete it. You must create a new hosted zone and update the name servers for your domain registration, which can require up to 48 hours to take effect. (If you delegated responsibility for a subdomain to a hosted zone and you delete the child hosted zone, you must update the name servers in the parent hosted zone.) In addition, if you delete a hosted zone, someone could hijack the domain and route traffic to their own resources using your domain name. If you want to avoid the monthly charge for the hosted zone, you can transfer DNS service for the domain to a free DNS service. When you transfer DNS service, you have to update the name servers for the domain registration. If the domain is registered with Route 53, see UpdateDomainNameservers for information about how to replace Route 53 name servers with name servers for the new DNS service. If the domain is registered with another registrar, use the method provided by the registrar to update name servers for the domain registration. For more information, perform an internet search on "free DNS service." You can delete a hosted zone only if it contains only the default SOA and NS records and has DNSSEC signing disabled. If the hosted zone contains other records or has DNSSEC enabled, you must delete the records and disable DNSSEC before deletion. Attempting to delete a hosted zone with additional records or DNSSEC enabled returns a HostedZoneNotEmpty error. For information about deleting records, see ChangeResourceRecordSets. To verify that the hosted zone has been deleted, do one of the following: Use the GetHostedZone action to request information about the hosted zone. Use the ListHostedZones action to get a list of the hosted zones associated with the current Amazon Web Services account.

DELETE FROM aws.route53.hosted_zones
WHERE id = '{{ id }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

activate_key_signing_key

Activates a key-signing key (KSK) so that it can be used for signing by DNSSEC. This operation changes the KSK status to ACTIVE.

EXEC aws.route53.hosted_zones.activate_key_signing_key 
@hosted_zone_id='{{ hosted_zone_id }}' --required, 
@name='{{ name }}' --required, 
@region='{{ region }}' --required
;

deactivate_key_signing_key

Deactivates a key-signing key (KSK) so that it will not be used for signing by DNSSEC. This operation changes the KSK status to INACTIVE.

EXEC aws.route53.hosted_zones.deactivate_key_signing_key 
@hosted_zone_id='{{ hosted_zone_id }}' --required, 
@name='{{ name }}' --required, 
@region='{{ region }}' --required
;

update_hosted_zone_comment

Updates the comment for a specified hosted zone.

EXEC aws.route53.hosted_zones.update_hosted_zone_comment 
@id='{{ id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"Comment": "{{ Comment }}"
}'
;

disable_hosted_zone_dnssec

Disables DNSSEC signing in a specific hosted zone. This action does not deactivate any key-signing keys (KSKs) that are active in the hosted zone.

EXEC aws.route53.hosted_zones.disable_hosted_zone_dnssec 
@id='{{ id }}' --required, 
@region='{{ region }}' --required
;

disassociate_vpc_from_hosted_zone

Disassociates an Amazon Virtual Private Cloud (Amazon VPC) from an Amazon Route 53 private hosted zone. Note the following: You can't disassociate the last Amazon VPC from a private hosted zone. You can't convert a private hosted zone into a public hosted zone. You can submit a DisassociateVPCFromHostedZone request using either the account that created the hosted zone or the account that created the Amazon VPC. Some services, such as Cloud Map and Amazon Elastic File System (Amazon EFS) automatically create hosted zones and associate VPCs with the hosted zones. A service can create a hosted zone using your account or using its own account. You can disassociate a VPC from a hosted zone only if the service created the hosted zone using your account. When you run DisassociateVPCFromHostedZone, if the hosted zone has a value for OwningAccount, you can use DisassociateVPCFromHostedZone. If the hosted zone has a value for OwningService, you can't use DisassociateVPCFromHostedZone. When revoking access, the hosted zone and the Amazon VPC must belong to the same partition. A partition is a group of Amazon Web Services Regions. Each Amazon Web Services account is scoped to one partition. The following are the supported partitions: aws - Amazon Web Services Regions aws-cn - China Regions aws-us-gov - Amazon Web Services GovCloud (US) Region For more information, see Access Management in the Amazon Web Services General Reference.

EXEC aws.route53.hosted_zones.disassociate_vpc_from_hosted_zone 
@id='{{ id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"VPC": "{{ VPC }}", 
"Comment": "{{ Comment }}"
}'
;

enable_hosted_zone_dnssec

Enables DNSSEC signing in a specific hosted zone.

EXEC aws.route53.hosted_zones.enable_hosted_zone_dnssec 
@id='{{ id }}' --required, 
@region='{{ region }}' --required
;

update_hosted_zone_features

Updates the features configuration for a hosted zone. This operation allows you to enable or disable specific features for your hosted zone, such as accelerated recovery. Accelerated recovery enables you to update DNS records in your public hosted zone even when the us-east-1 region is unavailable.

EXEC aws.route53.hosted_zones.update_hosted_zone_features 
@id='{{ id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"EnableAcceleratedRecovery": {{ EnableAcceleratedRecovery }}
}'
;