From ce25ef5078de6fcd87a7834b59eab4454e55fac6 Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Mon, 15 Dec 2025 14:12:31 -0500
Subject: [PATCH] cname module instead of alias record

---
 main.tf | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/main.tf b/main.tf
index f028bb1..c3a732b 100644
--- a/main.tf
+++ b/main.tf
@@ -29,8 +29,8 @@ resource "aws_route53_zone" "cluster_domain" {
   lifecycle {
     ignore_changes = [vpc]
     precondition {
-      condition     = local.is_shared_vpc && ! (var.vpc_domain_name == null || var.vpc_domain_name == "")
-      error_message = "var.vpc_domain_name must be provided when shared VPCs are in use."
+      condition     = ! (var.vpc_domain_name == null || var.vpc_domain_name == "")
+      error_message = "var.vpc_domain_name must be provided."
     }
   }
 
@@ -45,19 +45,19 @@ resource "aws_route53_zone" "cluster_domain" {
 # east region
 #---
 resource "aws_route53_vpc_association_authorization" "cluster_zone_east" {
-  count = local.region == "us-gov-east-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-east-1" ? 1 : 0
 
   provider   = aws.self
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["east"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 }
 
 resource "aws_route53_zone_association" "cluster_zone_east" {
-  count = local.region == "us-gov-east-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-east-1" ? 1 : 0
 
   provider   = aws.route53_main
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["east"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 
@@ -65,22 +65,22 @@ resource "aws_route53_zone_association" "cluster_zone_east" {
 }
 
 #-------------------------------------------------
-# west region
+# cluster PHZ Association west region
 #-------------------------------------------------
 resource "aws_route53_vpc_association_authorization" "cluster_zone_west" {
-  count = local.region == "us-gov-west-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-west-1" ? 1 : 0
 
   provider   = aws.self
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["west"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 }
 
 resource "aws_route53_zone_association" "cluster_zone_west" {
-  count = local.region == "us-gov-west-1" && local.is_shared_vpc ? 1 : 0
+  count = local.region == "us-gov-west-1" ? 1 : 0
 
   provider   = aws.route53_main
-  vpc_id     = data.aws_vpc.eks_vpc.id
+  vpc_id     = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
   vpc_region = var.region_map["west"]
   zone_id    = aws_route53_zone.cluster_domain.zone_id
 
@@ -180,3 +180,13 @@ resource "aws_route53_record" "entry" {
     evaluate_target_health = true
   }
 }
+
+# Equivalent module implementation
+# module "istio_ingress" {
+#   source = "git@github.e.it.census.gov:terraform-modules/aws-dns//cname"
+
+#   name = "*.${local.cluster_domain_name}"
+#   zone = aws_route53_zone.cluster_domain.zone_id
+#   values = [var.istio_ingress_lb.dns_name]
+#   enable_heritage = false
+# }