Creating an alias record for an existing hosted zone in Route53, does not find the zone with Python bindings

(I asked the below on https://stackoverflow.com/q/57691646/4556546, but did not have much luck.)

I am using the AWS CDK (with Python as my deployment language) and I am trying to add an alias record of an existing cloudfront distribution to an existing hosted zone. While I can get cdk synth to work, cdk deploy fails not finding the hosted zone.

I tested with AWS CDK version 1.5.0 (build c020efa) and 1.6.0 (build 3a0cde0).

I tried finding the zone like so:

zone = route53.HostedZone.from_hosted_zone_attributes(
	self,
	'MyHostedZone',
	zone_name = props.domainName,
	hosted_zone_id = 'Z1XXXXXXXXXS1'
)

And like so (also tried with PublicHostedZone):

zone = route53.HostedZone.from_lookup(
	self,
	'MyHostedZone',
	domain_name = props.domainName
)

And using it with (which works if a new hosted zone is created):

route53.ARecord(
	self,
	'SiteAliasRecord',
	record_name = siteDomain,
	target = route53.RecordTarget(alias_target=target),
	zone = zone
)

In both cases, the error message is:

StaticSiteHTTPS/SiteAliasRecord (StaticSiteHTTPSSiteAliasRecord9BXXXXX) No hosted zone found with ID: Z2XXX6BQ9TEB5H (Service: AmazonRoute53; Status Code: 404; Error Code: NoSuchHostedZone; Request ID:

I do not know where ID Z2XXX6BQ9TEB5H comes from it is not in my template and I do not have a hosted zone with this ID. Both generate a .template.json that contains:

"StaticSiteHTTPSSiteAliasRecord9BXXXXX": {
  "Type": "AWS::Route53::RecordSet",
  "Properties": {
    "Name": "dev.mydomain.com.",
    "Type": "A",
    "AliasTarget": {
      "DNSName": {
        "Fn::GetAtt": [
          "StaticSiteHTTPSSiteDistributionCFDistribution3BXXXXX",
          "DomainName"
        ]
      },
      "HostedZoneId": "Z2YYYYYYYYYW2"
    },
    "HostedZoneId": "Z1XXXXXXXXXXS1"
  },

from_lookup generates "HostedZoneId": "/hostedzone/Z1XXXXXXXXXXS1", while from_hosted_zone_attributes generates "HostedZoneId": "Z1XXXXXXXXXXS1" in template.json but either way deploy does not find the hosted zone. However, this seems to suggest that synth finds the hosted zone OK, running cdk context entries are created there by synth, too.

I also tried getting the hosted zone via from_hosted_zone_id and from_hosted_zone_attributes which also throw errors, but my understanding is that they do not actually look anything up in my account.

On a side note, creating a new hosted zone with the CDK works and it contains the alias record.

How can I debug this further? Should I be using a different mechanism to provide or lookup my hosted zone?

[helzich]

Today, I tried in antoher account and for a different domain. I still have the problem, now synth produces the correct zone ID, but deploy still tries to use a different one, so I am not surprised it fails. I have no idea why deploy would use a different zone ID.

[ilazakis]

I think the reason synth succeeds while deploy fails when using HostedZoneFromLookup is that the cdk optimistically assumes a successful lookup.

Here’s the synth output for domainHostedZone.HostedZoneId() (using Golang): DUMMY

That looks like a placeholder value in case of unsuccessful lookups.

In fact, after having fought this for a couple of hours, I think the answer to “why does the zone lookup sometimes fail” in my case is eventual consistency. After deleting and recreating the stack/zone in question a few times, I went for a walk, retried and the zone was now “found”.

I have not looked into the JS or Golang implementations yet, but I suspect many may be falling victims to the CDK trying to fallback to a dummy zone instead of failing outright.