route-53-subdomainslisted
Install: claude install-skill singleton-sd/ai-plattform-skills
# Route 53 subdomains (agents)
## Credentials
Bootstrap writes Key Vault secrets to `~/.config/pc-provision/company.secrets.env`. That file is **not** loaded automatically — export it into the **current shell** before any `aws` or `resolve-route53-zone` call:
```bash
SECRETS_FILE="${HOME}/.config/pc-provision/company.secrets.env"
if [[ ! -f "$SECRETS_FILE" ]]; then
echo "Missing ${SECRETS_FILE} — stop and use Human handoff below." >&2
exit 2
fi
set -a
# shellcheck source=/dev/null
source "$SECRETS_FILE"
set +a
for v in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY; do
val="${!v:-}"
if [[ -z "$val" || "$val" == REPLACE_ME ]]; then
echo "${v} missing or REPLACE_ME — stop and use Human handoff below." >&2
exit 2
fi
done
```
Rules:
- Never use root/admin AWS for routine DNS.
- Never run `create-aws-route53-user.sh` from agent work.
### Human handoff (missing file or `REPLACE_ME`)
**Stop.** Do not run provisioning commands yourself. Tell a human:
> Route 53 agent credentials are not ready in Key Vault / `company.secrets.env`.
>
> Human: clone [pc-provision](https://gitlab.com/singleton-sd/engineering/pc-provision), then from **Git Bash or WSL** with admin AWS (`aws login`) and `az login`:
>
> ```bash
> unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
> ./infra/create-aws-route53-user.sh
> ```
>
> Re-run pc-provision bootstrap (or Key Vault pull) so agents get real values, then retry DNS work.
## Resolve hosted zone ID
After loading credentials