Challengeaws
Production DNS & TLS with Route 53 and ACM — Challenge
Take a site from an IP address to a real domain over HTTPS, with a certificate that renews itself.
- Time
- 25 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Low cost
Before you start
You will need
- AWS CLI v2, configured
- A domain you control
You will be able to
- Choose between A, CNAME and ALIAS records deliberately
- Validate an ACM certificate by DNS and understand why it renews
- Plan a cutover around TTL instead of being surprised by it
Cost — Low cost
Low. A Route 53 hosted zone is $0.50/month and queries are fractions of a cent. ACM certificates are free. A domain, if you do not have one, is roughly $12/year.
You are done when
0 of 4
The goal#
Achieve the same outcome as Production DNS & TLS with Route 53 and ACM, from an empty starting point, without the steps.
The platform is reachable at d3bbb7tnfglcfh.cloudfront.net. That is fine for a test and unusable for anything real.
This is the same work that put egykode.com in front of this page, including the mistake that cost an hour.
What must be true when you are done#
- The site answers on your domain over HTTPS with a valid certificate.
- You can state why an ALIAS is used at the apex instead of a CNAME.
- The certificate's validation record is present and you can explain why it must stay.
- You can name the TTL on your record and what it means for a cutover.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
The concept behind it
Next up
Lab 17 of 58 on the project path