Amazon Route 53 DNS frontend
MD5 (route53d-0.01-alpha.tgz) = 490a7229b1e5044a7bfad6f97a440d30 Released 15th December 2010
Copyright (c) 2010 James Raftery. All rights reserved.
route53d is a DNS frontend to the Amazon Route 53 API. It allows you to use standard DNS tools to make changes to your Route 53 zones. At the moment it supports adding and deleting resource records by dynamic update (e.g with nsupdate).
Support for slaving from your master DNS server by incremental zone transfer (IXFR) and pushing zones changes to the API is nearly complete. It is available in the Google Code repository.
Download route53d-0.01-alpha.tgz. This is an early release. Please let me know how you fare. Email james .at. now .dot. ie
- boto. Route 53 support isn't yet in a Boto release. Take a source snapshot from Github.
- An active Amazon Route 53 account
- AWS Access Keys with access to your Route 53 service. Check the AWS blog for a recent article on service-specific keys if you'd prefer not to give route53d a full-access key.
- Install Python, dnspython and Boto according to their documentation. This may help
- route53d uses Boto to call the Route 53 API. Configure Boto with your AWS access key
- Create a config file. Use route53d.ini.sample as the starting point
- Start the daemon:
route53d.py [--config /path/to/route53d.ini]
Try it out
I have the daemon listening on localhost:5454 on my dev host. Feed nsupdate statements to create ten resource records:
% (echo "server 127.0.0.1 5454"; echo "zone foo.com."; for i in `jot -c 10 a`; do echo "update add $i.foo.com. 900 IN TXT foo-$i"; done; echo send) | nsupdate %
The logs from route53d say:
2010-12-15 22:33.22 GMT - 41805 - INFO - UPDATE from 127.0.0.1: foo.com. IN SOA 2010-12-15 22:33.24 GMT - 41805 - INFO - ChangeID: /change/C1752KTOAK42ZN Status: PENDING
And a few moments later the change is on the Route 53 DNS servers:
% for i in `jot -c 10 a`; do dig @ns-1649.awsdns-14.co.uk. $i.foo.com. txt +short; done "foo-a" "foo-b" "foo-c" "foo-d" "foo-e" "foo-f" "foo-g" "foo-h" "foo-i" "foo-j" %
Email me: james .at. now .dot. ie
Bug reports (with debug logs please!) and patches are very welcome!
- React to a NOTIFY message, use IXFR to fetch incremental changes from
an upstream DNS server, push each zone increment as one API call.
Status: 80% complete.
- Answer SOA queries for IXFR slave zones
- Respond with the current SOA for a zone that is slaved via IXFR to
allow DNS based monitoring of API update progress.
Status: 40% complete.
Not yet started
- Remove the deletion TTL kludge
- Need to be able to populate record TTLs in API delete calls. Query from DNS? Very non-atomic ...
- Use the ListHostedZones API
- Call the API at startup instead of configuring each HostedZone ID in the config file. For the moment I want the script to only mess with zones that have been specifically marked as safe to play with
- An upstream server responding to IXFR can require the client to fallback to AXFR
- Authenticate dynamic updates, notifies and IXFR/AXFR by TSIG. Maybe support authorization by IP address
- Pending change polling
- Maintain a queue of pending changes and poll the API asynchronously to log when a change is complete
- Review the process model
- It's a bit clunky. When the script internals settle down should see if there's a more appropriate way to split up the work
- Cleanly handle API limits
- Code for the maximum number of changes per call (1000) and maximum amount of record data (32000B) per call
At the moment there is no authentication. Be sure that
route53d isn't reachable from untrusted sources.
The DNS dynamic update mechanism allows deletion of 1) a specific resource-record, 2) a resource-record set, or 3) deletion of all records belonging to a name. The Route 53 API implements only specific resource-record deletion so route53d will reject requests for the other deletion types.
route53d is free software. It is released under a 3-clause BSD licence. The licence text is in the script.