From b363587acf65f5e7ffda37d10e166533e32da1e6 Mon Sep 17 00:00:00 2001
From: Phil <phil@tsol.re>
Date: Fri, 30 Oct 2026 08:39:46 -0600
Subject: [PATCH] Use a Route53-only IAM user for DNS changes

dns.yml no longer depends on an expiring 'aws login' session. The
ansible_dns user's keys are in vault_aws_dns and can only edit the
thesatelliteoflove.com and nerder.land zones. Also adds the id record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 dns.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dns.yml b/dns.yml
index 9f3e061..8f3b9d2 100644
--- a/dns.yml
+++ b/dns.yml
@@ -3,6 +3,12 @@
 - name: Add A Records for thesatelliteoflove.com and nerder.land
   hosts: localhost
   gather_facts: false
+
+  # Scoped IAM user (Route53 only) so this doesn't depend on an `aws login` session
+  module_defaults:
+    amazon.aws.route53:
+      access_key: "{{ vault_aws_dns.access_key }}"
+      secret_key: "{{ vault_aws_dns.secret_key }}"
   
   vars:
     # Domains to manage DNS records for
@@ -47,6 +53,8 @@
             ip: "{{ network.netcup_ip }}"
           - name: gokapi
             ip: "{{ network.netcup_ip }}"
+          - name: id
+            ip: "{{ network.netcup_ip }}"
       - name: nerder.land
         dns_records:
           - name: "forms"