Route 53 Hosted Zones
What does zop.dev create for Route 53 Hosted Zones?
zop.dev creates a Route 53 hosted zone, applies CAA records by default, and writes NS delegation records into a master zone hosted on GCP Cloud DNS, the same cross-cloud pattern Azure DNS zones use. Route 53 bills 0.50 USD per hosted zone per month, plus per-query charges once traffic resolves against it.
| Field | Value |
|---|---|
| Cloud | aws |
Amazon Route 53 hosts the DNS zones that route traffic to your environments. zop.dev provisions the zone with certificate-authority restrictions and delegates it into the organization’s master zone automatically.
A hosted zone with CAA and NS delegation
Hosted zone, CAA records, and NS delegation records into a GCP-hosted master zone.
Zone name, with CAA applied by default
Zone name; CAA records applied by default.Delegation into the GCP master zone
Delegation targets a GCP master zone: the same cross-cloud pattern used by Azure DNS and OCI DNS zones.
Delegation crosses a cloud boundary
The zone’s NS delegation records are written into a master zone hosted on GCP Cloud DNS, not into another Route 53 zone. Resolution for an AWS environment therefore begins at Google nameservers: a resolver walks from the master zone’s NS records down to the Route 53 zone that actually holds the environment’s records.
The consequence is a dependency most diagrams omit. The GCP master zone is shared, cross-cloud infrastructure. A bad edit there can break name resolution for environments on AWS that have nothing else to do with GCP. When DNS misbehaves for an AWS environment, the delegation chain is the second place to look, right after the zone itself.
CAA answers who may issue certificates
CAA records are applied by default, restricting which certificate authorities may issue for names in the zone. The protective story is the reason they exist: a compromised or confused CA cannot mint a certificate for your domain if it is not on the list.
The operational story is the one that bites. A certificate request through a CA that is not listed fails, and the failure surfaces as a mysterious issuance error in whatever tool made the request, nowhere near DNS. When a new cert workflow fails against a zone provisioned here, check the CAA records before blaming the ACME client.
The meter on a zone
A hosted zone bills 0.50 USD per month plus per-query charges (trivial for one zone, worth watching once every environment carries its own). The sharper issue with stale zones is not cost but correctness: a zone left behind by a deleted environment keeps resolving, and dangling records pointing at released load balancers or IPs are a well-documented takeover surface. Tearing down an environment should include its zone and its delegation records, in that order.