Don't ignore dualstack prefix in Route 53 alias names

[ngaya-ll]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Closes #6480
Closes #8013

Currently, Terraform ignores the presence or absence of a dualstack. prefix in the alias target name when comparing Route 53 alias records. However, the prefix is significant for aliases referencing an ELB as the un-prefixed domain name does not support AAAA queries.

The present normalization behavior was added in hashicorp/terraform#9704 by @stack72. In hashicorp/terraform#9628, @voltechs reported seeing a "perpetual diff" situation when using the unprefixed name, but I was not able to reproduce this behavior in a test case I added.

This PR removes the normalization logic, so that Terraform considers dualstack.example-123456789.region.elb.amazonaws.com and example-123456789.region.elb.amazonaws.com as distinct alias targets.

Release note for CHANGELOG:

Don't ignore dualstack prefix in Route 53 alias names.

Output from acceptance testing:

$ make testacc TEST=./aws TESTARGS='-run=TestAccAWSRoute53Record_Alias'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSRoute53Record_Alias -timeout 120m
=== RUN   TestAccAWSRoute53Record_Alias_Elb
=== PAUSE TestAccAWSRoute53Record_Alias_Elb
=== RUN   TestAccAWSRoute53Record_Alias_S3
=== PAUSE TestAccAWSRoute53Record_Alias_S3
=== RUN   TestAccAWSRoute53Record_Alias_VpcEndpoint
=== PAUSE TestAccAWSRoute53Record_Alias_VpcEndpoint
=== RUN   TestAccAWSRoute53Record_Alias_Uppercase
=== PAUSE TestAccAWSRoute53Record_Alias_Uppercase
=== RUN   TestAccAWSRoute53Record_AliasChange
=== PAUSE TestAccAWSRoute53Record_AliasChange
=== RUN   TestAccAWSRoute53Record_AliasChangeDualstack
=== PAUSE TestAccAWSRoute53Record_AliasChangeDualstack
=== CONT  TestAccAWSRoute53Record_Alias_Elb
=== CONT  TestAccAWSRoute53Record_AliasChange
=== CONT  TestAccAWSRoute53Record_Alias_S3
=== CONT  TestAccAWSRoute53Record_Alias_VpcEndpoint
=== CONT  TestAccAWSRoute53Record_Alias_Uppercase
=== CONT  TestAccAWSRoute53Record_AliasChangeDualstack
--- PASS: TestAccAWSRoute53Record_Alias_Uppercase (132.95s)
--- PASS: TestAccAWSRoute53Record_Alias_Elb (132.97s)
--- PASS: TestAccAWSRoute53Record_Alias_S3 (134.36s)
--- PASS: TestAccAWSRoute53Record_AliasChangeDualstack (178.90s)
--- PASS: TestAccAWSRoute53Record_AliasChange (183.16s)
--- PASS: TestAccAWSRoute53Record_Alias_VpcEndpoint (544.04s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	544.084s

[pascal-hofmann]

Workaround for A and AAAA records until this is merged:
Both A and AAAA records do not need to point to the dualstack. alias. They only resolve to either ipv4 or ipv6 addresses anyway.

So for…

• A records: Use no prefix at all
• AAAA records: Use ipv6. prefix instead of dualstack. prefix.

[Cellane]

@pascal-hofmann
I tried your workaround, thank you so much for posting it, but I don’t think it’s working for me.

First, I checked the DNS entries related to the load balancer:

• I get (presumably) correct IPv4 address when I run dig <load-balancer> A
• I get (presumably) correct IPv6 address when I run dig <load-balancer> AAAA
• I also get the same responses for dig dualstack.<load-balancer> A and dig dualstack.<load-balancer> AAAA
• However, dig ipv6.<load-balancer> AAAA returns nothing

After setting up records on <my-domain> with the prefixes you mentioned, I get sort of expected results:

• If I run dig <my-domain> A, I get the same IPv4 address as when I run dig <load-balancer> A
• However, if I run dig <my-domain> AAAA with the AAAA record pointing at the ipv6 prefix, I get the same no-answer.

It could be just an issue with DNS propagation (although I kept flushing local cache between tries, and run the dig commands with @ns-177.awsdns-22.com, a name-server associated with my domain & zone), but for me, it seems like no prefix actually works nowadays:

That’s because if I point both the A and AAAA records directly at load balancer’s dns_name, both dig <my-domain> A and dig <my-domain> AAAA seem to work just fine.

[alkis-hexa]

Hey guys,
is this going to be fixed ? I think AWS is now forcing on all A or AAAA records to use the "dualstack." in front of the Load Balancer even if the type of the Load Balancer is set to ipv4.

Even the below will not work as terraform is forcing the prefix out. On the AWS Console though it is as default to pick up the "dualstack." as prefix...

  source  = "terraform-aws-modules/route53/aws//modules/records"
  version = "~> 1.0"

  zone_name = data.aws_route53_zone.current.name
  records = [for record in ["test1", "test2", "test3"] :
    {
      name = record
      type = "A"
      alias = {
        name    =  format("dualstack.%s", module.alb_cluster_admin.this_lb_dns_name)
        zone_id = data.aws_route53_zone.current.zone_id
        ttl = 60
      }
    }
  ]

  depends_on = [module.alb_cluster_admin]
}

[zhelding]

Pull request #21306 has significantly refactored the AWS Provider codebase. As a result, most PRs opened prior to the refactor now have merge conflicts that must be resolved before proceeding.

Specifically, PR #21306 relocated the code for all AWS resources and data sources from a single aws directory to a large number of separate directories in internal/service, each corresponding to a particular AWS service. This separation of code has also allowed for us to simplify the names of underlying functions -- while still avoiding namespace collisions.

We recognize that many pull requests have been open for some time without yet being addressed by our maintainers. Therefore, we want to make it clear that resolving these conflicts in no way affects the prioritization of a particular pull request. Once a pull request has been prioritized for review, the necessary changes will be made by a maintainer -- either directly or in collaboration with the pull request author.

For a more complete description of this refactor, including examples of how old filepaths and function names correspond to their new counterparts: please refer to issue #20000.

For a quick guide on how to amend your pull request to resolve the merge conflicts resulting from this refactor and bring it in line with our new code patterns: please refer to our Service Package Refactor Pull Request Guide.

[YakDriver]

Looks good! Thanks 🎉

@ngaya-ll @pascal-hofmann @Cellane @alkis-hexa My apologies for the delay in this fix. Thank you for contributing to the resolution of the issue.

% make testacc TESTS=TestAccRoute53Record PKG=route53 
\==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/route53/... -v -count 1 -parallel 20 -run='TestAccRoute53Record'  -timeout 180m
--- PASS: TestAccRoute53Record_Allow_doNotOverwrite (180.26s)
--- PASS: TestAccRoute53Record_generatesSuffix (183.86s)
--- PASS: TestAccRoute53Record_Support_caa (184.99s)
--- PASS: TestAccRoute53Record_basic (207.79s)
--- PASS: TestAccRoute53Record_empty (224.79s)
--- PASS: TestAccRoute53Record_longTXTrecord (225.89s)
--- PASS: TestAccRoute53Record_Support_txt (231.39s)
--- PASS: TestAccRoute53Record_Support_ds (241.65s)
--- PASS: TestAccRoute53Record_Support_spf (242.87s)
--- PASS: TestAccRoute53Record_MultiValueAnswer_basic (254.16s)
--- PASS: TestAccRoute53Record_Geolocation_basic (256.62s)
--- PASS: TestAccRoute53Record_Allow_overwrite (272.25s)
--- PASS: TestAccRoute53Record_wildcard (311.05s)
--- PASS: TestAccRoute53Record_Alias_change (318.37s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_multiValueAnswer (323.69s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_latency (324.35s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_weighted (330.43s)
--- PASS: TestAccRoute53Record_Alias_changeDualstack (330.89s)
--- PASS: TestAccRoute53Record_HealthCheckID_setIdentifierChange (340.79s)
--- PASS: TestAccRoute53Record_Weighted_alias (393.48s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_failover (239.21s)
--- PASS: TestAccRoute53Record_Disappears_multipleRecords (244.72s)
--- PASS: TestAccRoute53Record_Latency_basic (182.14s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_geolocationContinent (258.21s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_geolocationCountrySpecified (225.71s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_geolocationCountrySubdivision (253.34s)
--- PASS: TestAccRoute53Record_fqdn (205.23s)
--- PASS: TestAccRoute53Record_typeChange (250.63s)
--- PASS: TestAccRoute53Record_trailingPeriodAndZoneID (166.81s)
--- PASS: TestAccRoute53Record_SetIdentifierRename_geolocationCountryDefault (265.72s)
--- PASS: TestAccRoute53Record_Disappears_basic (182.24s)
--- PASS: TestAccRoute53Record_Alias_uppercase (193.15s)
--- PASS: TestAccRoute53Record_Alias_s3 (189.23s)
--- PASS: TestAccRoute53Record_Weighted_basic (180.39s)
--- PASS: TestAccRoute53Record_Alias_elb (204.44s)
--- PASS: TestAccRoute53Record_setIdentifierChangeBasicToWeighted (284.84s)
--- PASS: TestAccRoute53Record_nameChange (298.55s)
--- PASS: TestAccRoute53Record_HealthCheckID_typeChange (303.39s)
--- PASS: TestAccRoute53Record_underscored (154.78s)
--- PASS: TestAccRoute53Record_failover (177.89s)
--- PASS: TestAccRoute53Record_WeightedToSimple_basic (215.13s)
--- PASS: TestAccRoute53Record_Alias_vpcEndpoint (507.18s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/route53	839.242s

[github-actions]

This functionality has been released in v4.24.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.