# Exercise 1: Multi-Region DNS for an API

`PetPal` runs its API in `eu-west-1` and `us-east-1` (both active), each behind an ALB. The marketing site is on CloudFront. Email is Google Workspace.

```
STEP 1. Write the records for the zone petpal.io:
        - apex petpal.io and www → CloudFront distribution (alias, A and AAAA)
        - api.petpal.io → latency-based alias records to both ALBs, each with
          evaluate_target_health and an HTTPS health check on /healthz
        - MX for Google Workspace, SPF (TXT), DMARC (TXT at _dmarc), and a CAA
          record allowing only Amazon to issue certificates
STEP 2. Add a weighted canary: within eu-west-1, send 10% of api traffic to a new
        ALB "api-v2" and 90% to the current one (nested: latency → weighted).
STEP 3. A private hosted zone internal.petpal.io associated with both VPCs, with
        db.internal.petpal.io → the RDS endpoint (CNAME) per region.
STEP 4. Estimate how long users in Europe keep hitting eu-west-1 after it fails
        completely (health check interval 30 s, failure threshold 3, ALB alias TTL 60 s).
STEP 5. Explain how to delegate dev.petpal.io to a hosted zone in the dev account.
```

Write records as Terraform (`aws_route53_record`) or CLI JSON change batches.

## Answers (TODO)

## Requirements Checklist

- [ ] Apex and www use alias records to CloudFront (zone id `Z2FDTNDATAQYW2`) for A and AAAA — no CNAME at the apex.
- [ ] api has two latency records (`set_identifier` per region, `latency_routing_policy { region }`) with health checks / evaluate_target_health.
- [ ] Email records: MX values for Google, `v=spf1 include:_spf.google.com ~all`, `_dmarc` TXT with a policy, `CAA 0 issue "amazon.com"`.
- [ ] Canary uses a nested structure (latency record → alias to a weighted record set with weights 90/10) or a traffic policy.
- [ ] Private hosted zone associated with both VPCs; records resolve only inside them.
- [ ] STEP 4: ~90 s detection (30 s × 3) + up to 60 s TTL ≈ 2.5 minutes, plus client caching.
- [ ] STEP 5: create `dev.petpal.io` zone in the dev account and add its four NS records as an NS record set in the parent zone.