A hosted zone holds the records for one domain. Route 53 serves it from four name servers.

The zone

ZONE=$(aws route53 create-hosted-zone --name monstermarket.example --caller-reference market-zone-1 --query HostedZone.Id --output text)

--caller-reference is any string never used before, so a retried command cannot make a second zone. The zone starts with two records: NS, its four name servers, and SOA. aws route53 get-hosted-zone --id $ZONE --query DelegationSet.NameServers --output text lists the four; later, ZONE=$(aws route53 list-hosted-zones-by-name --dns-name monstermarket.example --query "HostedZones[0].Id" --output text) finds the zone again.

Point the registration at it

Until the registration lists the four, the internet keeps asking the old host. Keep the first:

NS1=$(aws route53 get-hosted-zone --id $ZONE --query "DelegationSet.NameServers[0]" --output text)

and NS2 to NS4 the same way with [1], [2], [3]. Then:

aws route53domains update-domain-nameservers --domain-name monstermarket.example --nameservers Name=$NS1 Name=$NS2 Name=$NS3 Name=$NS4

On the internet this can take up to two days, while resolvers keep the old NS answers for their TTL; in this account it takes about a minute.

Records

A change batch is a list of changes, each an Action and a record set. Saved as www.json, with the shop's address:

{ "Changes": [ { "Action": "UPSERT", "ResourceRecordSet": {
  "Name": "www.monstermarket.example", "Type": "A", "TTL": 300,
  "ResourceRecords": [ { "Value": "54.210.33.17" } ] } } ] }

aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch file://www.json

CREATE refuses a set that exists, DELETE needs its current values, UPSERT creates or replaces. One bad change and nothing is applied (InvalidChangeBatch). To keep the change's id, run it this way instead: CHANGE=$(aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch file://www.json --query ChangeInfo.Id --output text). Then aws route53 get-change --id $CHANGE --query ChangeInfo.Status --output text says PENDING, then INSYNC: every Route 53 name server has it. aws route53 list-resource-record-sets --hosted-zone-id $ZONE --query "ResourceRecordSets[].[Name,Type,TTL]" --output table lists the zone.

To see a record without any cache, ask the zone itself:

dig @$NS1 www.monstermarket.example

A private zone

With the VPC's id in VPC, aws route53 create-hosted-zone --name market.internal --caller-reference market-internal-1 --vpc VPCRegion=us-east-1,VPCId=$VPC makes a private hosted zone: it answers only inside the VPCs associated with it, never on the internet; aws route53 associate-vpc-with-hosted-zone --hosted-zone-id $PRIVATE --vpc VPCRegion=us-east-1,VPCId=$OTHER lets one more VPC see it. The VPC needs DNS support and DNS hostnames on (Chapter 4's modify-vpc-attribute). A CNAME there whose value is the RDS endpoint gives the database a name of the market's own, db.market.internal. Inside an instance, sudo dnf install -y bind-utils gives it dig.

An office network reaches private names through a Route 53 Resolver inbound endpoint; an outbound endpoint sends the VPC's queries to the office's DNS. Each zone costs $0.50 a month.