6.1 KiB
Phase 24: AWS Route 53 DNS Sync - Discussion Log
Audit trail only. Do not use as input to planning, research, or execution agents. Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
Date: 2026-08-05 Phase: 24-AWS Route 53 DNS Sync Areas discussed: CRUD scope & guardrails, Change tracking & audit schema, Admin UI & sync integration
CRUD Scope & Guardrails
| Option | Description | Selected |
|---|---|---|
| Common types only | A, AAAA, CNAME, MX, TXT, SRV — the record types an MSP actually edits day-to-day. NS/SOA excluded. | ✓ |
| All record types | Includes NS/SOA — full parity with the AWS console, higher risk. | |
| Read-only for now | Ship sync + audit log first; defer writable types to a follow-up. |
User's choice: Common types only Notes: —
| Option | Description | Selected |
|---|---|---|
| Records only | Zones provisioned/decommissioned outside Pulse; Pulse only CRUDs records within existing zones. | ✓ |
| Zones + records | Pulse can also create/delete whole hosted zones. |
User's choice: Records only Notes: —
| Option | Description | Selected |
|---|---|---|
| Immediate, with full audit trail | Executes right away like other admin CRUD; every change logged with actor/before/after. | ✓ |
| Confirmation dialog only | Client-side "Are you sure?" modal, no server-side gate. | |
| Two-step approval gate | Mirrors phishing remediation — staged, second admin approves. |
User's choice: Immediate, with full audit trail Notes: —
| Option | Description | Selected |
|---|---|---|
| Admin + super-admin | Same bar as other write-capable admin surfaces (requireAdmin()). |
✓ |
| Super-admin only | Tighter gate given DNS-change blast radius. | |
| Any authenticated user | No role restriction. |
User's choice: Admin + super-admin Notes: —
Change Tracking & Audit Schema
| Option | Description | Selected |
|---|---|---|
| Dedicated Route 53 tables | New route53_* tables scoped to this integration, mirrors Veeam/Datto RMM. |
✓ |
| Reuse phishing's audit_events table | Shared cross-domain audit table. |
User's choice: Dedicated Route 53 tables Notes: —
| Option | Description | Selected |
|---|---|---|
| Log both, tagged by source | History rows tagged pulse_crud / sync_detected_drift. |
✓ |
| Only log Pulse-initiated CRUD | Sync silently overwrites current-state tables, no drift history. |
User's choice: Log both, tagged by source Notes: —
| Option | Description | Selected |
|---|---|---|
| Log failed attempts too | Audit row captures attempted before/after + error + status=failed. | ✓ |
| Only log successful changes | Failed API calls just console.error'd. |
User's choice: Log failed attempts too Notes: —
| Option | Description | Selected |
|---|---|---|
| Unbounded, no purge | Matches existing Pulse convention — no history/audit table currently purges. | ✓ |
| Time-boxed retention | Scheduled purge job for rows older than N months/years. |
User's choice: Unbounded, no purge Notes: —
Admin UI & Sync Integration
| Option | Description | Selected |
|---|---|---|
| New tile + detail page | /admin/sync tile + dedicated /admin/sync/route53 page — existing Veeam/Datto RMM/PAX8 pattern. |
✓ |
| Fold into an existing page | Attach DNS management to an existing admin section. |
User's choice: New tile + detail page Notes: —
| Option | Description | Selected |
|---|---|---|
| Display-only toggle | Disabling suppresses health-check display only; matches CLAUDE.md default for every integration except PAX8. | ✓ |
| Blocks sync + CRUD like PAX8 | Second exception alongside PAX8 — disabling also skips scheduler and 403s writes. |
User's choice: Display-only toggle Notes: —
| Option | Description | Selected |
|---|---|---|
| Daily full sync | One scheduled job/day, matches pax8-daily/engagement-daily cadence. | |
| Incremental + periodic full | More frequent incremental checks plus daily full reconciliation. | ✓ |
User's choice: Incremental + periodic full Notes: Accepted trade-off of more API calls against Route 53 rate limits for better real-time drift detection.
| Option | Description | Selected |
|---|---|---|
| Generic pattern | Same integration-health.ts shape — auth check + last-sync age. | |
| Add DNS-specific checks | Also flag degraded health on NS delegation mismatch vs registrar. | ✓ |
User's choice: Add DNS-specific checks Notes: Follow-up clarified how to determine "expected" NS — see next row.
| Option | Description | Selected |
|---|---|---|
| Live public DNS lookup | Query a public resolver (DoH or Node dns module) for the domain's NS records, diff against Route 53's authoritative set. |
✓ |
| Manual expected-NS field | Admin manually records expected NS per zone; check diffs against stored value. |
User's choice: Live public DNS lookup Notes: No manually-maintained field — the live lookup is itself the source of truth.
Claude's Discretion
- Credentials & AWS account scope — user deliberately did not select this
topic for discussion (treated as already settled by existing uncommitted
docker-entrypoint.sh/Dockerfile/docker-compose.ymlBWS wiring found during codebase scouting). Left to researcher/planner to confirm exact env var names and follow the existing factory pattern. See CONTEXT.md Claude's Discretion section for the full writeup. - AWS account scope (single account vs per-client) — not discussed; defaulted to single-account assumption.
- Exact record-change diff granularity — left to researcher/planner,
informed by the AWS SDK's
ChangeResourceRecordSetsshape. - Table/column naming inside the dedicated Route 53 schema — locked concept ("dedicated tables"), not literal names.
Deferred Ideas
None — discussion stayed within phase scope.