4a. Hosted zone + nameservers

Create the Route53 hosted zone, point your registrar's nameservers at the 4 AWS-assigned ones.

4b. ACM certificate (DNS-validated)

hcl

resource "aws_acm_certificate" "app" {
  domain_name       = "documind.qossim005.online"
  validation_method = "DNS"
}
# + validation record + aws_acm_certificate_validation

4c. AWS Load Balancer Controller

The legacy in-tree provisioner cannot attach an ACM cert to an NLB's TLS listener via annotations. Confirm:

bash

aws elbv2 describe-listeners --profile documind --load-balancer-arn <arn> --query "Listeners[].Protocol"

If ["TCP","TCP"] instead of ["TCP","TLS"], install the dedicated controller (own IRSA role, vpcId passed explicitly):

hcl

resource "helm_release" "lb_controller" {
  chart = "aws-load-balancer-controller"
  set { name = "vpcId"; value = module.vpc.vpc_id }
  set { name = "clusterName"; value = module.eks.cluster_name }
}

Ingress-nginx annotations (modern controller scheme):

hcl

set { name = "...aws-load-balancer-type"; value = "external" }
set { name = "...aws-load-balancer-nlb-target-type"; value = "ip" }
set { name = "...aws-load-balancer-scheme"; value = "internet-facing" }
set { name = "...aws-load-balancer-ssl-cert"; value = module.dns.certificate_arn }
set { name = "...aws-load-balancer-ssl-ports"; value = "https" }
set { name = "controller.service.targetPorts.https"; value = "http" }

4d. Point DNS at the NLB

bash

kubectl get svc -n ingress-nginx ingress-nginx-controller -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
# update module.dns's ingress_lb_hostname, terraform apply -target=module.dns
curl -vI https://documind.qossim005.online/

image.png

image.png