Monthly Archives: November 2015

How to have AWS instances update Route53 CNAME each time they boot

1 Reply

Recently I had a need for my AWS instances to dynamically update CNAME records each time they started. You’ll only get a dedicated IP if you purchase an Elastic IP, and then, only 5 per account unless you reach out to Amazon for more. Knowing that I’m both cheap and lazy, I wanted something that would be free, as well as, automatic. I found quite a few blogs and articles that were a big help, but no one ‘put it all together’ for me. After about 6 hours I’ve got a fully working solution, but please feel free to comment on where it can be improved.

This article makes the following assumptions: Ubuntu 14.04 LTS is being used as instance OS, External DNS domain is public, and hosted on Route 53.

I’m neither an AWS nor Linux daily user, so if you see something that could be improved, please do let me know.

Create AWS User, Group, and Policy for Dynamic DNS

  1. From the main AWS menu select “Route 53”
  2. Click “Hosted Zones” in the left hand column
  3. Click “Create Hosted Zone”
  4. Enter the Domain Name that will be updated by Servers, this can be a subdomain if desired.
  5. Type: Public Hosted Zone
  6. Click “Create”
  7. Once created, note the zone ID for later.
  8. From the main AWS menu select “Identity & Access Management”.
  9. Click “Policies” in the left hand pane
  10. Click “Get Started”
  11. Click “Create Policy”
  12. Click “Select” next to “Create Your Own Policy”
  13. Enter the following:
    1. Policy Name: change-dns-records
    2. Description: Allow Servers to update their own CNAME Records each time they reboot.
    3. Policy Document:
    4. NOTE: Replace <Zone ID> with the zone ID of the DNS zone the server needs to update.
    5. Click “Create Policy”
  14. Click “Groups” in the left hand pane
  15. Click “Create New Group”
  16. Name the group “DNS_Editors”, click “Next Step”
  17. Select the group policy “change-dns-records” and click “Next Step”
  18. Click “Create Group”
  19. Click “Users” in the left hand pane
  20. Click “Create New Users”
  21. In the “Enter User Names” box enter “dns-editor”
  22. Click “Create”
  23. Click “Show User Security Credentials”, note both the Access Key ID and Secret Access Key.
  24. Click “Close”
  25. Select the newly created user
  26. Click “Add User to Groups”
  27. Select “DNS_Editors” and then click “Add to Groups”

Install and configure CLI53

  1. Grab the URL for the most recent version from here: https://github.com/barnybug/cli53/releases/latest Make sure to download the proper version (I’m using AMD64)
  2. Login to Ubuntu instance and perform the following commands (Download cli53, move to /usr/local/bin, change permissions, create a sybolic link in /usr/bin, create route53 config file, and secure it):
  3. Edit the /etc/route53/config file and enter the following:
  4. NOTE: Replace <dns-editor’s access key ID> and <dns-editor’s secret access key> with appropriate values from the dns-editor user. Update YourDomain.com to match either your top level, or a subdomain of one of your domains.
  5. Next, create a file called /usr/sbin/update-route53-dns.sh Enter the following into the file:
  6. NOTE: replace [Client_URL_ShortName] in the above text with whatever you want to CNAME to be, I use the hostname of the server, but you could use anything (www. testing. mail. )  etc.
  7. NOTE:  it should not be necessary to have to delete the record and then re-create it, the –replace flag should be able to do that in a single command, however I could not get it to work in cli53 build 6.5.0, which is what was used here. I had to delete the existing CNAME and then re-create it. I also noticed that it is case sensitive, and always created as lower case, so in your delete command you need to make sure you are specifying the record to delete in all lowercase.
  8. NOTE: in some ami distributions ec2metadata needs to be replaced with ec2-metadata
  9. Lastly we need to add the script to the logon scripts that run during boot, enter the following commands:
  10. Reboot instance and verify that it’s created a CNAME for itself.