AaaaRecord

target

The hosted zone in which to define the new record.

zone

The object that is specified in resource record set object when you are linking a resource record set to a CIDR location.

A LocationName with an asterisk “*” can be used to create a default CIDR record. CollectionId is still required for default record.

cidrRoutingConfig

comment

Whether to delete the same record set in the hosted zone if it already exists (dangerous!).

This allows to deploy a new record set while minimizing the downtime because the
new record set will be created immediately after the existing one is deleted. It
also avoids "manual" actions to delete existing record sets.

> **N.B.:** this feature is dangerous, use with caution! It can only be used safely when
> `deleteExisting` is set to `true` as soon as the resource is added to the stack. Changing
> an existing Record Set's `deleteExisting` property from `false -> true` after deployment
> will delete the record!

deleteExisting

Failover configuration for the record set.

To configure failover, you add the Failover element to two resource record sets.
For one resource record set, you specify PRIMARY as the value for Failover;
for the other resource record set, you specify SECONDARY.

You must also include the HealthCheckId element for PRIMARY configurations.

failover

The geographical origin for this record to return DNS records based on the user's location.

geoLocation

The health check to associate with the record set.

Route53 will return this record set in response to DNS queries only if the health check is passing.

healthCheck

Whether to return multiple values, such as IP addresses for your web servers, in response to DNS queries.

multiValueAnswer

The subdomain name for this record. This should be relative to the zone root name.

For example, if you want to create a record for acme.example.com, specify
"acme".

You can also specify the fully qualified domain name which terminates with a
".". For example, "acme.example.com.".

recordName

The Amazon EC2 Region where you created the resource that this resource record set refers to.

The resource typically is an AWS resource, such as an EC2 instance or an ELB load balancer,
and is referred to by an IP address or a DNS domain name, depending on the record type.

When Amazon Route 53 receives a DNS query for a domain name and type for which you have created latency resource record sets,
Route 53 selects the latency resource record set that has the lowest latency between the end user and the associated Amazon EC2 Region.
Route 53 then returns the value that is associated with the selected resource record set.

region

A string used to distinguish between different records with the same combination of DNS name and type.

It can only be set when either weight or geoLocation is defined.

This parameter must be between 1 and 128 characters in length.

setIdentifier

The resource record cache time to live (TTL).

Among resource record sets that have the same combination of DNS name and type, a value that determines the proportion of DNS queries that Amazon Route 53 responds to using the current resource record set.

Route 53 calculates the sum of the weights for the resource record sets that have the same combination of DNS name and type.
Route 53 then responds to queries based on the ratio of a resource's weight to the total.

This value can be a number between 0 and 255.

weight

ARecord

A DNS Amazon CAA record.

A CAA record to restrict certificate authorities allowed
to issue certificates for a domain to Amazon only.

CaaAmazonRecord

CaaRecord

values

CnameRecord

The domain name of the target that this record should point to.

domainName

A Cross Account Zone Delegation record.

This construct uses custom resource lambda that calls Route53
ChangeResourceRecordSets API to upsert a NS record into the `parentHostedZone`.

WARNING: The default removal policy of this resource is DESTROY, therefore, if this resource's logical ID changes or
if this resource is removed from the stack, the existing NS record will be removed.

CrossAccountZoneDelegationRecord

delegatedZone

The delegation role in the parent account.

delegationRole

Region from which to obtain temporary credentials.

assumeRoleRegion

The hosted zone id in the parent account.

parentHostedZoneId

The hosted zone name in the parent account.

parentHostedZoneName

The removal policy to apply to the record set.

removalPolicy

DsRecord

Amazon Route 53 health checks monitor the health and performance of your web applications, web servers, and other resources.

Each health check that you create can monitor one of the following:
- The health of a resource, such as a web server,
- The status of other health checks, and
- The CloudWatch alarm that you specify,
- The status of an Amazon Route 53 routing control.

HealthCheck

The type of health check to be associated with the record.

type

CloudWatch alarm that you want Amazon Route 53 health checkers to use to determine whether the specified health check is healthy.

alarmIdentifier

A list of health checks to monitor for this 'CALCULATED' health check.

childHealthChecks

Specify whether you want Amazon Route 53 to send the value of FullyQualifiedDomainName to the endpoint in the client_hello message during TLS negotiation.

This allows the endpoint to respond to HTTPS health check requests with the applicable SSL/TLS certificate.

enableSNI

The number of consecutive health checks that an endpoint must pass or fail for Amazon Route 53 to change the current status of the endpoint from unhealthy to healthy or vice versa.

failureThreshold

Fully qualified domain name of the endpoint to be checked.

Amazon Route 53 behavior depends on whether you specify a value for IPAddress.

If you specify a value for IPAddress:

Amazon Route 53 sends health check requests to the specified IPv4 or IPv6 address and passes the value of FullyQualifiedDomainName in the Host header for all health checks except TCP health checks. This is typically the fully qualified DNS name of the endpoint on which you want Route 53 to perform health checks.
Note: If you specify a value for Port property other than 80 or 443, Route 53 will construct the value for Host header as FullyQualifiedDomainName:Port.

If you don't specify a value for IPAddress:

Route 53 sends a DNS request to the domain that you specify for FullyQualifiedDomainName at the interval that you specify for RequestInterval. Using an IPv4 address that DNS returns, Route 53 then checks the health of the endpoint.

Additionally, if the type of the health check is HTTP, HTTPS, HTTP_STR_MATCH, or HTTPS_STR_MATCH, Route 53 passes the value of FullyQualifiedDomainName in the Host header, as it does when you specify value for IPAddress. If the type is TCP, Route 53 doesn't pass a Host header.

fqdn

The number of child health checks that are associated with a CALCULATED health that Amazon Route 53 must consider healthy for the CALCULATED health check to be considered healthy.

healthThreshold

The status of the health check when CloudWatch has insufficient data about the state of associated alarm.

insufficientDataHealthStatus

Specify whether you want Amazon Route 53 to invert the status of a health check, so a health check that would normally be considered unhealthy is considered healthy, and vice versa.

inverted

The IPv4 or IPv6 IP address for the endpoint that you want Amazon Route 53 to perform health checks on.

If you don't specify a value for IPAddress, Route 53 sends a DNS request to resolve the domain name that you specify in FullyQualifiedDomainName at the interval that you specify in RequestInterval. Using an IPv4 address that DNS returns, Route 53 then checks the health of the endpoint.

ipAddress

Specify whether you want Amazon Route 53 to measure the latency between health checkers in multiple AWS regions and your endpoint, and to display CloudWatch latency graphs on the Health Checks page in the Route 53 console.

measureLatency

The port on the endpoint that you want Amazon Route 53 to perform health checks on.

port

An array of region identifiers that you want Amazon Route 53 health checkers to check the health of the endpoint from.

Please refer to the CloudFormation documentation for the most up-to-date list of regions.

regions

The duration between the time that Amazon Route 53 gets a response from your endpoint and the time that it sends the next health check request.

Each Route 53 health checker makes requests at this interval.

requestInterval

The path that you want Amazon Route 53 to request when performing health checks.

The path can be any value for which your endpoint will return an HTTP status code of 2xx or 3xx when the endpoint is healthy, for example the file /docs/route53-health-check.html. Route 53 automatically adds the DNS name for the service and a leading forward slash (/) character.

resourcePath

The Amazon Resource Name (ARN) of the Route 53 Application Recovery Controller routing control that you want Amazon Route 53 health checkers to use to determine whether the specified health check is healthy.

routingControl

The string that you want Amazon Route 53 to search for in the response body from the specified resource.

If the string appears in the response body, Route 53 considers the resource healthy.

Route 53 considers case when searching for SearchString in the response body.

searchString

Container for records, and records contain information about how to route traffic for a specific domain, such as example.com and its subdomains (acme.example.com, zenith.example.com).

Add another VPC to this private hosted zone.

addVpc

Enable DNSSEC for this hosted zone.

This will create a key signing key with the given options and enable DNSSEC signing
for the hosted zone.

enableDnssec

grantDelegation

HostedZone

A VPC that you want to associate with this hosted zone.

When you specify
this property, a private hosted zone will be created.

You can associate additional VPCs to this private zone using `addVpc(vpc)`.

vpcs

The name of the domain.

For resource record types that include a domain
name, specify a fully qualified domain name.

zoneName

Whether to add a trailing dot to the zone name.

addTrailingDot

Any comments that you want to include about the hosted zone.

The Amazon Resource Name (ARN) for the log group that you want Amazon Route 53 to send query logs to.

queryLogsLogGroupArn

HttpsRecord

The target (mostly used as an alias target to CloudFront).

A Key Signing Key for a Route 53 Hosted Zone.

KeySigningKey

The hosted zone that this key will be used to sign.

hostedZone

The customer-managed KMS key that that will be used to sign the records.

The KMS Key must be unique for each KSK within a hosted zone. Additionally, the
KMS key must be an asymetric customer-managed key using the ECC_NIST_P256 algorithm.

kmsKey

The name for the key signing key.

This name must be unique within a hosted zone.

keySigningKeyName

status

MxRecord

NsRecord

Create a Route53 private hosted zone for use in one or more VPCs.

Note that `enableDnsHostnames` and `enableDnsSupport` must have been enabled
for the VPC you're configuring for private hosted zones.

PrivateHostedZone

A VPC that you want to associate with this hosted zone.

Private hosted zones must be associated with at least one VPC. You can
associated additional VPCs using `addVpc(vpc)`.

Adds a delegation from this zone to a designated zone.

addDelegation

PublicHostedZone

Whether to create a CAA record to restrict certificate authorities allowed to issue certificates for this domain to Amazon only.

caaAmazon

A principal which is trusted to assume a role for zone delegation.

If supplied, this will create a Role in the same account as the Hosted
Zone, which can be assumed by the `CrossAccountZoneDelegationRecord` to
create a delegation record to a zone in a different account.

Be sure to indicate the account(s) that you trust to create delegation
records, using either `iam.AccountPrincipal` or `iam.OrganizationPrincipal`.

If you are planning to use `iam.ServicePrincipal`s here, be sure to include
region-specific service principals for every opt-in region you are going to
be delegating to; or don't use this feature and create separate roles
with appropriate permissions for every opt-in region instead.

crossAccountZoneDelegationPrincipal

The name of the role created for cross account delegation.

crossAccountZoneDelegationRoleName

RecordSet

recordType

The target for this record, either `RecordTarget.fromValues()` or `RecordTarget.fromAlias()`.

SrvRecord

SvcbRecord

TxtRecord

A Private DNS configuration for a VPC endpoint service.

VpcEndpointServiceDomainName

The domain name to use.

This domain name must be owned by this account (registered through Route53),
or delegated to this account. Domain ownership will be verified by AWS before
private DNS can be used.

The VPC Endpoint Service to configure Private DNS for.

endpointService

The public hosted zone to use for the domain.

publicHostedZone

A record to delegate further lookups to a different set of name servers.

ZoneDelegationRecord

The name servers to report in the delegation records.

nameServers

Creates a CIDR collection in the current AWS account.

CfnCidrCollection

name

A complex type that contains information about the list of CIDR locations.

locations

The `AWS::Route53::DNSSEC` resource is used to enable DNSSEC signing in a hosted zone.

CfnDNSSEC

A unique string (ID) that is used to identify a hosted zone.

For example: `Z00001111A1ABCaaABC11` .

hostedZoneId

The `AWS::Route53::HealthCheck` resource is a Route 53 resource type that contains settings for a Route 53 health check.

For information about associating health checks with records, see [HealthCheckId](https://docs.aws.amazon.com/Route53/latest/APIReference/API_ResourceRecordSet.html#Route53-Type-ResourceRecordSet-HealthCheckId) in [ChangeResourceRecordSets](https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeResourceRecordSets.html) .

> You can't create a health check with simple routing.

*ELB Load Balancers*

If you're registering EC2 instances with an Elastic Load Balancing (ELB) load balancer, do not create Amazon Route 53 health checks for the EC2 instances. When you register an EC2 instance with a load balancer, you configure settings for an ELB health check, which performs a similar function to a Route 53 health check.

*Private Hosted Zones*

You can associate health checks with failover records in a private hosted zone. Note the following:

- Route 53 health checkers are outside the VPC. To check the health of an endpoint within a VPC by IP address, you must assign a public IP address to the instance in the VPC.
- You can configure a health checker to check the health of an external resource that the instance relies on, such as a database server.
- You can create a CloudWatch metric, associate an alarm with the metric, and then create a health check that is based on the state of the alarm. For example, you might create a CloudWatch metric that checks the status of the Amazon EC2 `StatusCheckFailed` metric, add an alarm to the metric, and then create a health check that is based on the state of the alarm. For information about creating CloudWatch metrics and alarms by using the CloudWatch console, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/WhatIsCloudWatch.html) .

CfnHealthCheck

A complex type that contains detailed information about one health check.

For the values to enter for `HealthCheckConfig` , see [HealthCheckConfig](https://docs.aws.amazon.com/Route53/latest/APIReference/API_HealthCheckConfig.html)

healthCheckConfig

The `HealthCheckTags` property describes key-value pairs that are associated with an `AWS::Route53::HealthCheck` resource.

healthCheckTags

Creates a new public or private hosted zone.

You create records in a public hosted zone to define how you want to route traffic on the internet for a domain, such as example.com, and its subdomains (apex.example.com, acme.example.com). You create records in a private hosted zone to define how you want to route traffic for a domain and its subdomains within one or more Amazon Virtual Private Clouds (Amazon VPCs).

> You can't convert a public hosted zone to a private hosted zone or vice versa. Instead, you must create a new hosted zone with the same name and create new resource record sets.

For more information about charges for hosted zones, see [Amazon Route 53 Pricing](https://docs.aws.amazon.com/route53/pricing/) .

Note the following:

- You can't create a hosted zone for a top-level domain (TLD) such as .com.
- If your domain is registered with a registrar other than Route 53, you must update the name servers with your registrar to make Route 53 the DNS service for the domain. For more information, see [Migrating DNS Service for an Existing Domain to Amazon Route 53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/MigratingDNS.html) in the *Amazon Route 53 Developer Guide* .

When you submit a `CreateHostedZone` request, the initial status of the hosted zone is `PENDING` . For public hosted zones, this means that the NS and SOA records are not yet available on all Route 53 DNS servers. When the NS and SOA records are available, the status of the zone changes to `INSYNC` .

The `CreateHostedZone` request requires the caller to have an `ec2:DescribeVpcs` permission.

> When creating private hosted zones, the Amazon VPC must belong to the same partition where the hosted zone is created. A partition is a group of AWS Regions . Each AWS account is scoped to one partition.
>
> The following are the supported partitions:
>
> - `aws` - AWS Regions
> - `aws-cn` - China Regions
> - `aws-us-gov` - AWS GovCloud (US) Region
>
> For more information, see [Access Management](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in the *AWS General Reference* .

CfnHostedZone

A complex type that contains an optional comment.

If you don't want to specify a comment, omit the `HostedZoneConfig` and `Comment` elements.

hostedZoneConfig

The features configuration for the hosted zone, including accelerated recovery settings and status information.

hostedZoneFeatures

Adds, edits, or deletes tags for a health check or a hosted zone.

For information about using tags for cost allocation, see [Using Cost Allocation Tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the *Billing and Cost Management User Guide* .

hostedZoneTags

The name of the domain.

Specify a fully qualified domain name, for example, *www.example.com* . The trailing dot is optional; Amazon Route 53 assumes that the domain name is fully qualified. This means that Route 53 treats *www.example.com* (without a trailing dot) and *www.example.com.* (with a trailing dot) as identical.

If you're creating a public hosted zone, this is the name you have registered with your DNS registrar. If your domain name is registered with a registrar other than Route 53, change the name servers for your domain to the set of `NameServers` that are returned by the `Fn::GetAtt` intrinsic function.

Creates a configuration for DNS query logging.

After you create a query logging configuration, Amazon Route 53 begins to publish log data to an Amazon CloudWatch Logs log group.

DNS query logs contain information about the queries that Route 53 receives for a specified public hosted zone, such as the following:

- Route 53 edge location that responded to the DNS query
- Domain or subdomain that was requested
- DNS record type, such as A or AAAA
- DNS response code, such as `NoError` or `ServFail`

- **Log Group and Resource Policy** - Before you create a query logging configuration, perform the following operations.

> If you create a query logging configuration using the Route 53 console, Route 53 performs these operations automatically.

- Create a CloudWatch Logs log group, and make note of the ARN, which you specify when you create a query logging configuration. Note the following:

- You must create the log group in the us-east-1 region.
- You must use the same AWS account to create the log group and the hosted zone that you want to configure query logging for.
- When you create log groups for query logging, we recommend that you use a consistent prefix, for example:

`/aws/route53/ *hosted zone name*`

In the next step, you'll create a resource policy, which controls access to one or more log groups and the associated AWS resources, such as Route 53 hosted zones. There's a limit on the number of resource policies that you can create, so we recommend that you use a consistent prefix so you can use the same resource policy for all the log groups that you create for query logging.
- Create a CloudWatch Logs resource policy, and give it the permissions that Route 53 needs to create log streams and to send query logs to log streams. You must create the CloudWatch Logs resource policy in the us-east-1 region. For the value of `Resource` , specify the ARN for the log group that you created in the previous step. To use the same resource policy for all the CloudWatch Logs log groups that you created for query logging configurations, replace the hosted zone name with `*` , for example:

`arn:aws:logs:us-east-1:123412341234:log-group:/aws/route53/*`

To avoid the confused deputy problem, a security issue where an entity without a permission for an action can coerce a more-privileged entity to perform it, you can optionally limit the permissions that a service has to a resource in a resource-based policy by supplying the following values:

- For `aws:SourceArn` , supply the hosted zone ARN used in creating the query logging configuration. For example, `aws:SourceArn: arn:aws:route53:::hostedzone/hosted zone ID` .
- For `aws:SourceAccount` , supply the account ID for the account that creates the query logging configuration. For example, `aws:SourceAccount:111111111111` .

For more information, see [The confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) in the *AWS IAM User Guide* .

> You can't use the CloudWatch console to create or edit a resource policy. You must use the CloudWatch API, one of the AWS SDKs, or the AWS CLI .
- **Log Streams and Edge Locations** - When Route 53 finishes creating the configuration for DNS query logging, it does the following:

- Creates a log stream for an edge location the first time that the edge location responds to DNS queries for the specified hosted zone. That log stream is used to log all queries that Route 53 responds to for that edge location.
- Begins to send query logs to the applicable log stream.

The name of each log stream is in the following format:

`*hosted zone ID* / *edge location code*`

The edge location code is a three-letter code and an arbitrarily assigned number, for example, DFW3. The three-letter code typically corresponds with the International Air Transport Association airport code for an airport near the edge location. (These abbreviations might change in the future.) For a list of edge locations, see "The Route 53 Global Network" on the [Route 53 Product Details](https://docs.aws.amazon.com/route53/details/) page.
- **Queries That Are Logged** - Query logs contain only the queries that DNS resolvers forward to Route 53. If a DNS resolver has already cached the response to a query (such as the IP address for a load balancer for example.com), the resolver will continue to return the cached response. It doesn't forward another query to Route 53 until the TTL for the corresponding resource record set expires. Depending on how many DNS queries are submitted for a resource record set, and depending on the TTL for that resource record set, query logs might contain information about only one query out of every several thousand queries that are submitted to DNS. For more information about how DNS works, see [Routing Internet Traffic to Your Website or Web Application](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html) in the *Amazon Route 53 Developer Guide* .
- **Log File Format** - For a list of the values in each query log and the format of each value, see [Logging DNS Queries](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html) in the *Amazon Route 53 Developer Guide* .
- **Pricing** - For information about charges for query logs, see [Amazon CloudWatch Pricing](https://docs.aws.amazon.com/cloudwatch/pricing/) .
- **How to Stop Logging** - If you want Route 53 to stop sending query logs to CloudWatch Logs, delete the query logging configuration. For more information, see [DeleteQueryLoggingConfig](https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteQueryLoggingConfig.html) .

queryLoggingConfig

*Private hosted zones:* A complex type that contains information about the VPCs that are associated with the specified hosted zone.

> For public hosted zones, omit `VPCs` , `VPCId` , and `VPCRegion` .

The `AWS::Route53::KeySigningKey` resource creates a new key-signing key (KSK) in a hosted zone.

The hosted zone ID is passed as a parameter in the KSK properties. You can specify the properties of this KSK using the `Name` , `Status` , and `KeyManagementServiceArn` properties of the resource.

CfnKeySigningKey

The unique string (ID) that is used to identify a hosted zone.

For example: `Z00001111A1ABCaaABC11` .

The Amazon resource name (ARN) for a customer managed customer master key (CMK) in AWS Key Management Service ( AWS  ).

The `KeyManagementServiceArn` must be unique for each key-signing key (KSK) in a single hosted zone. For example: `arn:aws:kms:us-east-1:111122223333:key/111a2222-a11b-1ab1-2ab2-1ab21a2b3a111` .

keyManagementServiceArn

A string used to identify a key-signing key (KSK).

`Name` can include numbers, letters, and underscores (_). `Name` must be unique for each key-signing key in the same hosted zone.

A string that represents the current key-signing key (KSK) status.

Status can have one of the following values:

- **ACTIVE** - The KSK is being used for signing.
- **INACTIVE** - The KSK is not being used for signing.
- **DELETING** - The KSK is in the process of being deleted.
- **ACTION_NEEDED** - There is a problem with the KSK that requires you to take action to resolve. For example, the customer managed key might have been deleted, or the permissions for the customer managed key might have been changed.
- **INTERNAL_FAILURE** - There was an error during a request. Before you can continue to work with DNSSEC signing, including actions that involve this KSK, you must correct the problem. For example, you may need to activate or deactivate the KSK.

Information about the record that you want to create.

The `AWS::Route53::RecordSet` type can be used as a standalone resource or as an embedded property in the `AWS::Route53::RecordSetGroup` type. Note that some `AWS::Route53::RecordSet` properties are valid only when used within `AWS::Route53::RecordSetGroup` .

For more information, see [ChangeResourceRecordSets](https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeResourceRecordSets.html) in the *Amazon Route 53 API Reference* .

CfnRecordSet

The name of the record that you want to create, update, or delete.

Enter a fully qualified domain name, for example, `www.example.com` . You can optionally include a trailing dot. If you omit the trailing dot, Amazon Route 53 assumes that the domain name that you specify is fully qualified. This means that Route 53 treats `www.example.com` (without a trailing dot) and `www.example.com.` (with a trailing dot) as identical.

For information about how to specify characters other than `a-z` , `0-9` , and `-` (hyphen) and how to specify internationalized domain names, see [DNS Domain Name Format](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DomainNameFormat.html) in the *Amazon Route 53 Developer Guide* .

You can use the asterisk (*) wildcard to replace the leftmost label in a domain name, for example, `*.example.com` . Note the following:

- The * must replace the entire label. For example, you can't specify `*prod.example.com` or `prod*.example.com` .
- The * can't replace any of the middle labels, for example, marketing.*.example.com.
- If you include * in any position other than the leftmost label in a domain name, DNS treats it as an * character (ASCII 42), not as a wildcard.

> You can't use the * wildcard for resource records sets that have a type of NS.

The DNS record type.

For information about different record types and how data is encoded for them, see [Supported DNS Resource Record Types](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html) in the *Amazon Route 53 Developer Guide* .

Valid values for basic resource record sets: `A` | `AAAA` | `CAA` | `CNAME` | `DS` | `MX` | `NAPTR` | `NS` | `PTR` | `SOA` | `SPF` | `SRV` | `TXT` | `TLSA` | `SSHFP` | `SVCB` | `HTTPS`

Values for weighted, latency, geolocation, and failover resource record sets: `A` | `AAAA` | `CAA` | `CNAME` | `MX` | `NAPTR` | `PTR` | `SPF` | `SRV` | `TXT` | `TLSA` | `SSHFP` | `SVCB` | `HTTPS` . When creating a group of weighted, latency, geolocation, or failover resource record sets, specify the same value for all of the resource record sets in the group.

Valid values for multivalue answer resource record sets: `A` | `AAAA` | `MX` | `NAPTR` | `PTR` | `SPF` | `SRV` | `TXT` | `CAA` | `TLSA` | `SSHFP` | `SVCB` | `HTTPS`

> SPF records were formerly used to verify the identity of the sender of email messages. However, we no longer recommend that you create resource record sets for which the value of `Type` is `SPF` . RFC 7208, *Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1* , has been updated to say, "...[I]ts existence and mechanism defined in [RFC4408] have led to some interoperability issues. Accordingly, its use is no longer appropriate for SPF version 1; implementations are not to use it." In RFC 7208, see section 14.1, [The SPF DNS Record Type](https://docs.aws.amazon.com/http://tools.ietf.org/html/rfc7208#section-14.1) .

Values for alias resource record sets:

- *Amazon API Gateway custom regional APIs and edge-optimized APIs:* `A`
- *CloudFront distributions:* `A`

If IPv6 is enabled for the distribution, create two resource record sets to route traffic to your distribution, one with a value of `A` and one with a value of `AAAA` .
- *Amazon API Gateway environment that has a regionalized subdomain* : `A`
- *ELB load balancers:* `A` | `AAAA`
- *Amazon S3 buckets:* `A`
- *Amazon Virtual Private Cloud interface VPC endpoints* `A`
- *Another resource record set in this hosted zone:* Specify the type of the resource record set that you're creating the alias for. All values are supported except `NS` and `SOA` .

> If you're creating an alias record that has the same name as the hosted zone (known as the zone apex), you can't route traffic to a record for which the value of `Type` is `CNAME` . This is because the alias record must have the same type as the record you're routing traffic to, and creating a CNAME record for the zone apex isn't supported even for an alias record.

*Alias resource record sets only:* Information about the AWS resource, such as a CloudFront distribution or an Amazon S3 bucket, that you want to route traffic to.

If you're creating resource records sets for a private hosted zone, note the following:

- You can't create an alias resource record set in a private hosted zone to route traffic to a CloudFront distribution.
- For information about creating failover resource record sets in a private hosted zone, see [Configuring Failover in a Private Hosted Zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-private-hosted-zones.html) in the *Amazon Route 53 Developer Guide* .

aliasTarget

The object that is specified in resource record set object when you are linking a resource record set to a CIDR location.

A `LocationName` with an asterisk “*” can be used to create a default CIDR record. `CollectionId` is still required for default record.

*Optional:* Any comments you want to include about a change batch request.

*Failover resource record sets only:* To configure failover, you add the `Failover` element to two resource record sets.

For one resource record set, you specify `PRIMARY` as the value for `Failover` ; for the other resource record set, you specify `SECONDARY` . In addition, you include the `HealthCheckId` element and specify the health check that you want Amazon Route 53 to perform for each resource record set.

Except where noted, the following failover behaviors assume that you have included the `HealthCheckId` element in both resource record sets:

- When the primary resource record set is healthy, Route 53 responds to DNS queries with the applicable value from the primary resource record set regardless of the health of the secondary resource record set.
- When the primary resource record set is unhealthy and the secondary resource record set is healthy, Route 53 responds to DNS queries with the applicable value from the secondary resource record set.
- When the secondary resource record set is unhealthy, Route 53 responds to DNS queries with the applicable value from the primary resource record set regardless of the health of the primary resource record set.
- If you omit the `HealthCheckId` element for the secondary resource record set, and if the primary resource record set is unhealthy, Route 53 always responds to DNS queries with the applicable value from the secondary resource record set. This is true regardless of the health of the associated endpoint.

You can't create non-failover resource record sets that have the same values for the `Name` and `Type` elements as failover resource record sets.

For failover alias resource record sets, you must also include the `EvaluateTargetHealth` element and set the value to true.

For more information about configuring failover for Route 53, see the following topics in the *Amazon Route 53 Developer Guide* :

- [Route 53 Health Checks and DNS Failover](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html)
- [Configuring Failover in a Private Hosted Zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-private-hosted-zones.html)

*Geolocation resource record sets only:* A complex type that lets you control how Amazon Route 53 responds to DNS queries based on the geographic origin of the query.

For example, if you want all queries from Africa to be routed to a web server with an IP address of `192.0.2.111` , create a resource record set with a `Type` of `A` and a `ContinentCode` of `AF` .

If you create separate resource record sets for overlapping geographic regions (for example, one resource record set for a continent and one for a country on the same continent), priority goes to the smallest geographic region. This allows you to route most queries for a continent to one resource and to route queries for a country on that continent to a different resource.

You can't create two geolocation resource record sets that specify the same geographic location.

The value `*` in the `CountryCode` element matches all geographic locations that aren't specified in other geolocation resource record sets that have the same values for the `Name` and `Type` elements.

> Geolocation works by mapping IP addresses to locations. However, some IP addresses aren't mapped to geographic locations, so even if you create geolocation resource record sets that cover all seven continents, Route 53 will receive some DNS queries from locations that it can't identify. We recommend that you create a resource record set for which the value of `CountryCode` is `*` . Two groups of queries are routed to the resource that you specify in this record: queries that come from locations for which you haven't created geolocation resource record sets and queries from IP addresses that aren't mapped to a location. If you don't create a `*` resource record set, Route 53 returns a "no answer" response for queries from those locations.

You can't create non-geolocation resource record sets that have the same values for the `Name` and `Type` elements as geolocation resource record sets.

*GeoproximityLocation resource record sets only:* A complex type that lets you control how Route 53 responds to DNS queries based on the geographic origin of the query and your resources.

geoProximityLocation

If you want Amazon Route 53 to return this resource record set in response to a DNS query only when the status of a health check is healthy, include the `HealthCheckId` element and specify the ID of the applicable health check.

Route 53 determines whether a resource record set is healthy based on one of the following:

- By periodically sending a request to the endpoint that is specified in the health check
- By aggregating the status of a specified group of health checks (calculated health checks)
- By determining the current state of a CloudWatch alarm (CloudWatch metric health checks)

> Route 53 doesn't check the health of the endpoint that is specified in the resource record set, for example, the endpoint specified by the IP address in the `Value` element. When you add a `HealthCheckId` element to a resource record set, Route 53 checks the health of the endpoint that you specified in the health check.

For more information, see the following topics in the *Amazon Route 53 Developer Guide* :

- [How Amazon Route 53 Determines Whether an Endpoint Is Healthy](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-determining-health-of-endpoints.html)
- [Route 53 Health Checks and DNS Failover](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html)
- [Configuring Failover in a Private Hosted Zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-private-hosted-zones.html)

*When to Specify HealthCheckId*

Specifying a value for `HealthCheckId` is useful only when Route 53 is choosing between two or more resource record sets to respond to a DNS query, and you want Route 53 to base the choice in part on the status of a health check. Configuring health checks makes sense only in the following configurations:

- *Non-alias resource record sets* : You're checking the health of a group of non-alias resource record sets that have the same routing policy, name, and type (such as multiple weighted records named www.example.com with a type of A) and you specify health check IDs for all the resource record sets.

If the health check status for a resource record set is healthy, Route 53 includes the record among the records that it responds to DNS queries with.

If the health check status for a resource record set is unhealthy, Route 53 stops responding to DNS queries using the value for that resource record set.

If the health check status for all resource record sets in the group is unhealthy, Route 53 considers all resource record sets in the group healthy and responds to DNS queries accordingly.
- *Alias resource record sets* : You specify the following settings:

- You set `EvaluateTargetHealth` to true for an alias resource record set in a group of resource record sets that have the same routing policy, name, and type (such as multiple weighted records named www.example.com with a type of A).
- You configure the alias resource record set to route traffic to a non-alias resource record set in the same hosted zone.
- You specify a health check ID for the non-alias resource record set.

If the health check status is healthy, Route 53 considers the alias resource record set to be healthy and includes the alias record among the records that it responds to DNS queries with.

If the health check status is unhealthy, Route 53 stops responding to DNS queries using the alias resource record set.

> The alias resource record set can also route traffic to a *group* of non-alias resource record sets that have the same routing policy, name, and type. In that configuration, associate health checks with all of the resource record sets in the group of non-alias resource record sets.

*Geolocation Routing*

For geolocation resource record sets, if an endpoint is unhealthy, Route 53 looks for a resource record set for the larger, associated geographic region. For example, suppose you have resource record sets for a state in the United States, for the entire United States, for North America, and a resource record set that has `*` for `CountryCode` is `*` , which applies to all locations. If the endpoint for the state resource record set is unhealthy, Route 53 checks for healthy resource record sets in the following order until it finds a resource record set for which the endpoint is healthy:

- The United States
- North America
- The default resource record set

*Specifying the Health Check Endpoint by Domain Name*

If your health checks specify the endpoint only by domain name, we recommend that you create a separate health check for each endpoint. For example, create a health check for each `HTTP` server that is serving content for `www.example.com` . For the value of `FullyQualifiedDomainName` , specify the domain name of the server (such as `us-east-2-www.example.com` ), not the name of the resource record sets ( `www.example.com` ).

> Health check results will be unpredictable if you do the following:
>
> - Create a health check that has the same value for `FullyQualifiedDomainName` as the name of a resource record set.
> - Associate that health check with the resource record set.

healthCheckId

The ID of the hosted zone that you want to create records in.

Specify either `HostedZoneName` or `HostedZoneId` , but not both. If you have multiple hosted zones with the same domain name, you must specify the hosted zone using `HostedZoneId` .

The name of the hosted zone that you want to create records in.

You must include a trailing dot (for example, `www.example.com.` ) as part of the `HostedZoneName` .

When you create a stack using an AWS::Route53::RecordSet that specifies `HostedZoneName` , AWS CloudFormation attempts to find a hosted zone whose name matches the HostedZoneName. If AWS CloudFormation cannot find a hosted zone with a matching domain name, or if there is more than one hosted zone with the specified domain name, AWS CloudFormation will not create the stack.

Specify either `HostedZoneName` or `HostedZoneId` , but not both. If you have multiple hosted zones with the same domain name, you must specify the hosted zone using `HostedZoneId` .

hostedZoneName

*Multivalue answer resource record sets only* : To route traffic approximately randomly to multiple resources, such as web servers, create one multivalue answer record for each resource and specify `true` for `MultiValueAnswer` .

Note the following:

- If you associate a health check with a multivalue answer resource record set, Amazon Route 53 responds to DNS queries with the corresponding IP address only when the health check is healthy.
- If you don't associate a health check with a multivalue answer record, Route 53 always considers the record to be healthy.
- Route 53 responds to DNS queries with up to eight healthy records; if you have eight or fewer healthy records, Route 53 responds to all DNS queries with all the healthy records.
- If you have more than eight healthy records, Route 53 responds to different DNS resolvers with different combinations of healthy records.
- When all records are unhealthy, Route 53 responds to DNS queries with up to eight unhealthy records.
- If a resource becomes unavailable after a resolver caches a response, client software typically tries another of the IP addresses in the response.

You can't create multivalue answer alias records.

*Latency-based resource record sets only:* The Amazon EC2 Region where you created the resource that this resource record set refers to.

The resource typically is an AWS resource, such as an EC2 instance or an ELB load balancer, and is referred to by an IP address or a DNS domain name, depending on the record type.

When Amazon Route 53 receives a DNS query for a domain name and type for which you have created latency resource record sets, Route 53 selects the latency resource record set that has the lowest latency between the end user and the associated Amazon EC2 Region. Route 53 then returns the value that is associated with the selected resource record set.

Note the following:

- You can only specify one `ResourceRecord` per latency resource record set.
- You can only create one latency resource record set for each Amazon EC2 Region.
- You aren't required to create latency resource record sets for all Amazon EC2 Regions. Route 53 will choose the region with the best latency from among the regions that you create latency resource record sets for.
- You can't create non-latency resource record sets that have the same values for the `Name` and `Type` elements as latency resource record sets.

One or more values that correspond with the value that you specified for the `Type` property.

For example, if you specified `A` for `Type` , you specify one or more IP addresses in IPv4 format for `ResourceRecords` . For information about the format of values for each record type, see [Supported DNS Resource Record Types](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html) in the *Amazon Route 53 Developer Guide* .

Note the following:

- You can specify more than one value for all record types except CNAME and SOA.
- The maximum length of a value is 4000 characters.
- If you're creating an alias record, omit `ResourceRecords` .

resourceRecords

*Resource record sets that have a routing policy other than simple:* An identifier that differentiates among multiple resource record sets that have the same combination of name and type, such as multiple weighted resource record sets named acme.example.com that have a type of A. In a group of resource record sets that have the same name and type, the value of `SetIdentifier` must be unique for each resource record set.

For information about routing policies, see [Choosing a Routing Policy](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html) in the *Amazon Route 53 Developer Guide* .

The resource record cache time to live (TTL), in seconds. Note the following:.

- If you're creating or updating an alias resource record set, omit `TTL` . Amazon Route 53 uses the value of `TTL` for the alias target.
- If you're associating this resource record set with a health check (if you're adding a `HealthCheckId` element), we recommend that you specify a `TTL` of 60 seconds or less so clients respond quickly to changes in health status.
- All of the resource record sets in a group of weighted resource record sets must have the same value for `TTL` .
- If a group of weighted resource record sets includes one or more weighted alias resource record sets for which the alias target is an ELB load balancer, we recommend that you specify a `TTL` of 60 seconds for all of the non-alias weighted resource record sets that have the same name and type. Values other than 60 seconds (the TTL for load balancers) will change the effect of the values that you specify for `Weight` .

*Weighted resource record sets only:* Among resource record sets that have the same combination of DNS name and type, a value that determines the proportion of DNS queries that Amazon Route 53 responds to using the current resource record set.

Route 53 calculates the sum of the weights for the resource record sets that have the same combination of DNS name and type. Route 53 then responds to queries based on the ratio of a resource's weight to the total. Note the following:

- You must specify a value for the `Weight` element for every weighted resource record set.
- You can only specify one `ResourceRecord` per weighted resource record set.
- You can't create latency, failover, or geolocation resource record sets that have the same values for the `Name` and `Type` elements as weighted resource record sets.
- You can create a maximum of 100 weighted resource record sets that have the same values for the `Name` and `Type` elements.
- For weighted (but not weighted alias) resource record sets, if you set `Weight` to `0` for a resource record set, Route 53 never responds to queries with the applicable value for that resource record set. However, if you set `Weight` to `0` for all resource record sets that have the same combination of DNS name and type, traffic is routed to all resources with equal probability.

The effect of setting `Weight` to `0` is different when you associate health checks with weighted resource record sets. For more information, see [Options for Configuring Route 53 Active-Active and Active-Passive Failover](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-configuring-options.html) in the *Amazon Route 53 Developer Guide* .

A complex type that contains an optional comment, the name and ID of the hosted zone that you want to make changes in, and values for the records that you want to create.

Amazon Route 53

L2 Constructs21