feat: mTLS AWS <> Cloudflare & DNSSEC

[swiknaba]

PR

Summary

• Automate DNSSEC registration for Route 53 domains using Cloudflare’s generated DNSSEC key.
• Add Cloudflare Authenticated Origin Pulls with ALB-enforced mTLS.
• Add certificate generation and leaf-rotation scripts, plus secure CA storage guidance.
• Integrate both features into the AWS application stack with tests and documentation.

Reasoning

DNSSEC protects the domain’s DNS delegation from tampering. mTLS ensures the ALB only accepts requests authenticated with our Cloudflare certificate, blocking direct-origin traffic—and traffic proxied through another Cloudflare account—before it reaches the application. Automated certificate rotation keeps this manageable across many projects.

---

Changelog

New

Route 53 Domains DNSSEC registration (aws/route53domains-dnssec)

Registers an external DNS provider's DNSSEC key (e.g. Cloudflare's KSK) with a domain registered in Route 53 Domains, completing the chain of trust. Integrated into stack/app behind the opt-in route53domains_dnssec_enabled variable (default false). If your domain already has a manually registered DNSSEC key, import it before enabling — see the module README.

mTLS between Cloudflare and the ALB (aws/alb-mtls)

Cloudflare Authenticated Origin Pulls with a custom per-zone client certificate, verified by the ALB against an S3-backed trust store. Prevents attackers from bypassing Cloudflare and hitting the ALB directly. New stack variables: alb_mtls_ca_certificates_pem, alb_mtls_mode, authenticated_origin_pull. Helper scripts: script/generate-mtls-certs.sh, script/rotate-mtls-certificates.sh. Read the rollout warning in aws/alb-mtls/README.md before enabling on a live ALB — deploy Cloudflare first, then passthrough, then verify.

⚠️ Breaking changes — stack/app

1. New required provider alias aws.us-east-1 (Route 53 Domains API only exists in us-east-1). Every consumer of stack/app must pass it, even when not using DNSSEC:

   # The Route 53 Domains (registrar) API only exists in us-east-1.
   # The stack needs this provider for DNSSEC key registration.
   provider "aws" {
     alias  = "us-east-1"
     region = "us-east-1"
   }
   
   module "stack" {
     source = "github.com/dbl-works/terraform//aws/stack/app?ref=main"
   
     providers = {
       aws           = aws
       aws.peer      = aws.peer
       aws.us-east-1 = aws.us-east-1
     }
     # ...unchanged...
   }