fix(aws): preserve live API network identities

Author: richiemcilroy

infra/aws/environments/production.tfvars.example

@@ -6,6 +6,7 @@ availability_zones = ["us-east-1a", "us-east-1b"]
 vpc_cidr            = "10.42.0.0/16"
 
 api_route53_zone_id  = "replace-me-with-bootstrap-api-zone-id"
+playback_route53_zone_id = "replace-me-with-bootstrap-playback-zone-id"
 api_domain_name      = "api.rend.so"
 playback_domain_name = "video.rend.so"
 internal_domain_name = "origin.api.rend.so"

infra/aws/platform/delivery.tf

@@ -1,8 +1,9 @@
 resource "aws_acm_certificate" "public" {
   provider = aws.us_east_1
 
-  domain_name       = var.api_domain_name
-  validation_method = "DNS"
+  domain_name               = var.api_domain_name
+  subject_alternative_names = [var.playback_domain_name]
+  validation_method         = "DNS"
 
   lifecycle {
     create_before_destroy = true
@@ -18,7 +19,11 @@ resource "aws_route53_record" "certificate_validation" {
     }
   }
 
-  zone_id         = var.api_route53_zone_id
+  zone_id = (
+    each.key == var.playback_domain_name
+    ? var.playback_route53_zone_id
+    : var.api_route53_zone_id
+  )
   name            = each.value.name
   type            = each.value.type
   records         = [each.value.record]
@@ -67,10 +72,15 @@ resource "aws_acm_certificate_validation" "internal" {
 
 
 resource "aws_route53_record" "public_ipv4" {
-  count = var.services_enabled ? 1 : 0
+  for_each = var.services_enabled ? {
+    api = {
+      name    = var.api_domain_name
+      zone_id = var.api_route53_zone_id
+    }
+  } : {}
 
-  zone_id = var.api_route53_zone_id
-  name    = var.api_domain_name
+  zone_id = each.value.zone_id
+  name    = each.value.name
   type    = "A"
 
   alias {

infra/aws/platform/network.tf

@@ -141,7 +141,7 @@ resource "aws_vpc_endpoint" "planetscale" {
 
 resource "aws_security_group" "origin_alb" {
   name        = "${local.resource_prefix}-origin-alb"
-  description = "Internal Rend API and ClickHouse ALB"
+  description = "CloudFront VPC Origin to the internal Rend ALB"
   vpc_id      = aws_vpc.this.id
 
   egress {
@@ -185,7 +185,7 @@ resource "aws_vpc_security_group_ingress_rule" "public_api_ipv6" {
 
 resource "aws_security_group" "ecs" {
   name        = "${local.resource_prefix}-ecs"
-  description = "Rend API traffic from the public and internal ALBs"
+  description = "Rend API and edge traffic from the internal ALB"
   vpc_id      = aws_vpc.this.id
 
   egress {

infra/aws/platform/variables.tf

@@ -48,6 +48,11 @@ variable "api_route53_zone_id" {
   type        = string
 }
 
+variable "playback_route53_zone_id" {
+  description = "Delegated playback zone retained for the existing certificate validation record; Tigris serves playback through the authoritative CNAME."
+  type        = string
+}
+
 variable "api_domain_name" {
   description = "Public API hostname routed directly to the public ALB."
   type        = string