aws-cdk-lib.aws_route53.ZoneSigningOptions

ZoneSigningOptions Struct

Options for enabling key signing from a hosted zone.

Source

aws-route53/lib/hosted-zone.ts

Type last changed

v2.138.0 · 18 Apr 2024

Example

const kmsKey = new kms.Key(this, 'KmsCMK', {
  keySpec: kms.KeySpec.ECC_NIST_P256,
  keyUsage: kms.KeyUsage.SIGN_VERIFY,
});
const hostedZone = new route53.HostedZone(this, 'HostedZone', {
  zoneName: 'example.com',
});
// Enable DNSSEC signing for the zone
hostedZone.enableDnssec({ kmsKey });

Properties

keySigningKeyName?optionalstringkey_signing_key_name?optionalstrkeySigningKeyName?optionalStringKeySigningKeyName?optionalstringKeySigningKeyName?optional*string#

The name for the key signing key.

Default: an autogenerated name

This name must be unique within a hosted zone.

kmsKeyIKeykms_keyIKeykmsKeyIKeyKmsKeyIKeyKmsKeyIKeyrequired#

The customer-managed KMS key that will be used to sign the records.

The KMS Key must be unique for each KSK within a hosted zone. Additionally, the KMS key must be an asymetric customer-managed key using the ECC_NIST_P256 algorithm.