# Phase 24: AWS Route 53 DNS Sync - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.

**Date:** 2026-08-05
**Phase:** 24-AWS Route 53 DNS Sync
**Areas discussed:** CRUD scope & guardrails, Change tracking & audit schema, Admin UI & sync integration

---

## CRUD Scope & Guardrails

| Option | Description | Selected |
|--------|-------------|----------|
| Common types only | A, AAAA, CNAME, MX, TXT, SRV — the record types an MSP actually edits day-to-day. NS/SOA excluded. | ✓ |
| All record types | Includes NS/SOA — full parity with the AWS console, higher risk. | |
| Read-only for now | Ship sync + audit log first; defer writable types to a follow-up. | |

**User's choice:** Common types only
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Records only | Zones provisioned/decommissioned outside Pulse; Pulse only CRUDs records within existing zones. | ✓ |
| Zones + records | Pulse can also create/delete whole hosted zones. | |

**User's choice:** Records only
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Immediate, with full audit trail | Executes right away like other admin CRUD; every change logged with actor/before/after. | ✓ |
| Confirmation dialog only | Client-side "Are you sure?" modal, no server-side gate. | |
| Two-step approval gate | Mirrors phishing remediation — staged, second admin approves. | |

**User's choice:** Immediate, with full audit trail
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Admin + super-admin | Same bar as other write-capable admin surfaces (`requireAdmin()`). | ✓ |
| Super-admin only | Tighter gate given DNS-change blast radius. | |
| Any authenticated user | No role restriction. | |

**User's choice:** Admin + super-admin
**Notes:** —

---

## Change Tracking & Audit Schema

| Option | Description | Selected |
|--------|-------------|----------|
| Dedicated Route 53 tables | New `route53_*` tables scoped to this integration, mirrors Veeam/Datto RMM. | ✓ |
| Reuse phishing's audit_events table | Shared cross-domain audit table. | |

**User's choice:** Dedicated Route 53 tables
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Log both, tagged by source | History rows tagged `pulse_crud` / `sync_detected_drift`. | ✓ |
| Only log Pulse-initiated CRUD | Sync silently overwrites current-state tables, no drift history. | |

**User's choice:** Log both, tagged by source
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Log failed attempts too | Audit row captures attempted before/after + error + status=failed. | ✓ |
| Only log successful changes | Failed API calls just console.error'd. | |

**User's choice:** Log failed attempts too
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Unbounded, no purge | Matches existing Pulse convention — no history/audit table currently purges. | ✓ |
| Time-boxed retention | Scheduled purge job for rows older than N months/years. | |

**User's choice:** Unbounded, no purge
**Notes:** —

---

## Admin UI & Sync Integration

| Option | Description | Selected |
|--------|-------------|----------|
| New tile + detail page | `/admin/sync` tile + dedicated `/admin/sync/route53` page — existing Veeam/Datto RMM/PAX8 pattern. | ✓ |
| Fold into an existing page | Attach DNS management to an existing admin section. | |

**User's choice:** New tile + detail page
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Display-only toggle | Disabling suppresses health-check display only; matches CLAUDE.md default for every integration except PAX8. | ✓ |
| Blocks sync + CRUD like PAX8 | Second exception alongside PAX8 — disabling also skips scheduler and 403s writes. | |

**User's choice:** Display-only toggle
**Notes:** —

| Option | Description | Selected |
|--------|-------------|----------|
| Daily full sync | One scheduled job/day, matches pax8-daily/engagement-daily cadence. | |
| Incremental + periodic full | More frequent incremental checks plus daily full reconciliation. | ✓ |

**User's choice:** Incremental + periodic full
**Notes:** Accepted trade-off of more API calls against Route 53 rate limits for better real-time drift detection.

| Option | Description | Selected |
|--------|-------------|----------|
| Generic pattern | Same integration-health.ts shape — auth check + last-sync age. | |
| Add DNS-specific checks | Also flag degraded health on NS delegation mismatch vs registrar. | ✓ |

**User's choice:** Add DNS-specific checks
**Notes:** Follow-up clarified how to determine "expected" NS — see next row.

| Option | Description | Selected |
|--------|-------------|----------|
| Live public DNS lookup | Query a public resolver (DoH or Node `dns` module) for the domain's NS records, diff against Route 53's authoritative set. | ✓ |
| Manual expected-NS field | Admin manually records expected NS per zone; check diffs against stored value. | |

**User's choice:** Live public DNS lookup
**Notes:** No manually-maintained field — the live lookup is itself the source of truth.

---

## Claude's Discretion

- **Credentials & AWS account scope** — user deliberately did not select this
  topic for discussion (treated as already settled by existing uncommitted
  `docker-entrypoint.sh`/`Dockerfile`/`docker-compose.yml` BWS wiring found
  during codebase scouting). Left to researcher/planner to confirm exact
  env var names and follow the existing factory pattern. See CONTEXT.md
  Claude's Discretion section for the full writeup.
- AWS account scope (single account vs per-client) — not discussed;
  defaulted to single-account assumption.
- Exact record-change diff granularity — left to researcher/planner,
  informed by the AWS SDK's `ChangeResourceRecordSets` shape.
- Table/column naming inside the dedicated Route 53 schema — locked concept
  ("dedicated tables"), not literal names.

## Deferred Ideas

None — discussion stayed within phase scope.
