cname module instead of alias record

main.tf

@@ -29,8 +29,8 @@ resource "aws_route53_zone" "cluster_domain" {
   lifecycle {
     ignore_changes = [vpc]
     precondition {
-      condition     = local.is_shared_vpc && ! (var.vpc_domain_name == null || var.vpc_domain_name == "")
-      error_message = "var.vpc_domain_name must be provided when shared VPCs are in use."
+      condition     = ! (var.vpc_domain_name == null || var.vpc_domain_name == "")
+      error_message = "var.vpc_domain_name must be provided."
     }
   }
 
@@ -45,42 +45,42 @@ resource "aws_route53_zone" "cluster_domain" {
 # east region
 #---
 resource "aws_route53_vpc_association_authorization" "cluster_zone_east" {
-  count = local.region == "us-gov-east-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-east-1" ? 1 : 0
 
   provider   = aws.self
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["east"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 }
 
 resource "aws_route53_zone_association" "cluster_zone_east" {
-  count = local.region == "us-gov-east-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-east-1" ? 1 : 0
 
   provider   = aws.route53_main
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["east"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 
   depends_on = [aws_route53_vpc_association_authorization.cluster_zone_east]
 }
 
 #-------------------------------------------------
-# west region
+# cluster PHZ Association west region
 #-------------------------------------------------
 resource "aws_route53_vpc_association_authorization" "cluster_zone_west" {
-  count = local.region == "us-gov-west-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-west-1" ? 1 : 0
 
   provider   = aws.self
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["west"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 }
 
 resource "aws_route53_zone_association" "cluster_zone_west" {
-  count = local.region == "us-gov-west-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-west-1" ? 1 : 0
 
   provider   = aws.route53_main
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["west"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 
@@ -180,3 +180,13 @@ resource "aws_route53_record" "entry" {
     evaluate_target_health = true
   }
 }
+
+# Equivalent module implementation
+# module "istio_ingress" {
+#   source = "git@github.e.it.census.gov:terraform-modules/aws-dns//cname"
+
+#   name = "*.${local.cluster_domain_name}"
+#   zone = aws_route53_zone.cluster_domain.zone_id
+#   values = [var.istio_ingress_lb.dns_name]
+#   enable_heritage = false
+# }