// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc

:_mod-docs-content-type: PROCEDURE
[id="hcp-aws-set-up-ext-dns_{context}"]
= Setting up external DNS for {hcp}

[role="_abstract"]
To automate the management of DNS records, you can set up external DNS for {hcp} on {aws-short}. You need this configuration to ensure that when you create or modify services, the corresponding DNS records in your {aws-short} Route 53 public hosted zones update automatically.

You can provision {hcp} with external DNS or service-level DNS.

.Prerequisites

* You created an external public domain.

* You have access to the {aws-short} Route53 Management console.

* You enabled {aws-short} PrivateLink for {hcp}.

.Procedure

. Create an {aws-first} credential secret for the HyperShift Operator and name it `hypershift-operator-external-dns-credentials` in the `local-cluster` namespace.

. Verify that the secret has the required fields. For your reference, the required fields are detailed in the following table.
+
.Required fields for the {aws-short} secret
[options="header"]
|===
| Field name | Description | Optional or required

| `provider`
| The DNS provider that manages the service-level DNS zone.
| Required

| `domain-filter`
| The service-level domain.
| Required

| `credentials`
| The credential file that supports all external DNS types.
| Optional when you use {aws-short} keys

| `aws-access-key-id`
| The credential access key id.
| Optional when you use the {aws-short} DNS service

| `aws-secret-access-key`
| The credential access key secret.
| Optional when you use the {aws-short} DNS service
|===

. Create an {aws-short} secret by running the following command:
+
[source,terminal]
----
$ oc create secret generic <secret_name> \
  --from-literal=provider=aws \
  --from-literal=domain-filter=<domain_name> \
  --from-file=credentials=<path_to_aws_credentials_file> -n local-cluster
----
+
[NOTE]
====
Disaster recovery backup for the secret is not automatically enabled. To back up the secret for disaster recovery, add the `hypershift-operator-external-dns-credentials` by entering the following command:
[source,terminal]
----
$ oc label secret hypershift-operator-external-dns-credentials \
  -n local-cluster \
  cluster.open-cluster-management.io/backup=""
----
====
