bug: The response for CreateHostedZone in route53 misses the DelegationSet

[stof]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When calling CreateHostedZone, the response does not contain DelegationSet, even though the API definition files of AWS SDKs describe it as a required field of the response shape.

Expected Behavior

The response should have the DelegationSet to match the AWS behavior.

How are you starting LocalStack?

With a docker run command

Steps To Reproduce

How are you starting localstack (e.g., bin/localstack command, arguments, or docker-compose.yml)

docker run -d -p 4576:4566 -e SERVICES=route53 -v /var/run/docker.sock:/var/run/docker.sock --name async_aws_localstack-route53 localstack/localstack:2.3.2

Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)

https://github.com/async-aws/aws/blob/516667a7e77905dcf5c2ca470e7ab141c857f466/src/Service/Route53/tests/Integration/Route53ClientTest.php#L81-L100

This is the test that fails when updating localstack from 0.14.2 to 2.3.2 because the response parsing expects the required field to be present.

Environment

- OS: Ubuntu 22.04
- LocalStack:2.3.2

Anything else?

For reference, here is the response returned when using localstack 2.3.2:

<?xml version='1.0' encoding='utf-8'?>
<CreateHostedZoneResponse><HostedZone><Id>/hostedzone/KVRMC4FVNEG7536</Id><Name>test-domain.com.</Name><Config><Comment>foo</Comment><PrivateZone>true</PrivateZone></Config><ResourceRecordSetCount>2</ResourceRecordSetCount></HostedZone><ChangeInfo><Id>/change/C1PA6795UKMFR9</Id><Status>INSYNC</Status><SubmittedAt>2017-03-15T01:36:41.958000Z</SubmittedAt></ChangeInfo><VPC><VPCRegion /><VPCId /></VPC></CreateHostedZoneResponse>

And here is the response using localstack 0.14.2

<CreateHostedZoneResponse xmlns="https://route53.amazonaws.com/doc/2012-12-12/">
   <HostedZone>
      <Id>/hostedzone/HPWU1OMIC5LRCWS</Id>
      <Name>test-domain.com.</Name>
      <ResourceRecordSetCount>0</ResourceRecordSetCount>
      <Config>
        
            <Comment>foo</Comment>
        
        <PrivateZone>true</PrivateZone>
      </Config>
   </HostedZone>
   <DelegationSet>
      <Id>9WZOG</Id>
      <NameServers>
         <NameServer>ns-2048.awsdns-64.com</NameServer><NameServer>ns-2049.awsdns-65.net</NameServer><NameServer>ns-2050.awsdns-66.org</NameServer><NameServer>ns-2051.awsdns-67.co.uk</NameServer>
      </NameServers>
   </DelegationSet>
   <VPC>
      <VPCId></VPCId>
      <VPCRegion></VPCRegion>
   </VPC>
</CreateHostedZoneResponse>

Note that this is broken since a long time as attempting to run this test using localstack 1.0.0 also breaks.

[simonrw]

Hi, thanks for reporting this issue. I cannot reproduce this either locally or against AWS. When I create a hosted zone with the Python equivalent code from your PHP sample, there is no delegation set in the response. There is a delegation set when not including PrivateZone=true, and in fact we have a snapshotted test to capture that behaviour:

localstack/tests/aws/services/route53/test_route53.py

Lines 14 to 24 in a77e4f8

	@markers.aws.validated
	@markers.snapshot.skip_snapshot_verify(
	paths=["$..DelegationSet.Id", "$..HostedZone.CallerReference"]
	)
	def test_create_hosted_zone(self, aws_client, hosted_zone, snapshot):
	response = hosted_zone(Name=f"zone-{short_uid()}.com")
	zone_id = response["HostedZone"]["Id"]
	snapshot.match("create_hosted_zone_response", response)
	response = aws_client.route53.get_hosted_zone(Id=zone_id)
	snapshot.match("get_hosted_zone", response)

with captured output

localstack/tests/aws/services/route53/test_route53.snapshot.json

Lines 5 to 28 in a77e4f8

	"create_hosted_zone_response": {
	"ChangeInfo": {
	"Id": "/change/<change-id>",
	"Status": "<status:1>",
	"SubmittedAt": "datetime"
	},
	"DelegationSet": {
	"NameServers": "<name-server>"
	},
	"HostedZone": {
	"CallerReference": "<caller-reference:1>",
	"Config": {
	"PrivateZone": false
	},
	"Id": "/hostedzone/<zone-id:1>",
	"Name": "<zone_name:1>",
	"ResourceRecordSetCount": 2
	},
	"Location": "https://route53.amazonaws.com/2013-04-01/hostedzone/<zone-id:1>",
	"ResponseMetadata": {
	"HTTPHeaders": {},
	"HTTPStatusCode": 201
	}
	},

[stof]

The API description in the AWS SDK says that DelegationSet is a required member of the CreateHostedZoneResponse: https://github.com/aws/aws-sdk-php/blob/9ae3bfd036190847dd0a5c3cdc4681dbb0994f5a/src/data/route53/2013-04-01/api-2.json#L1677-L1696

Are you saying that the API description maintained by AWS is wrong and this DelegationSet is actually optional ?

[stof]

Btw, if <PrivateZone>true</PrivateZone> has a different response structure, maybe you should also have a snapshot test covering this case.

[simonrw]

Thanks for the suggestion. In the attached PR #9885 you can see I have created a snapshot test to capture AWS behaviour.

Three things were uncovered while testing this:

• The syntax in your PHP example does not work for me in Python, as boto3 raises a client validation error where the VPC details are required for private hosted zones.
• The official docs show an example response for a private hosted zone. It does not include the DelegationSet information.
• The reference for DelegationSet does not say that it is a required field in the response body.

This makes sense to me. The docs say "For public hosted zones, Route 53 automatically creates a default SOA record and four NS records for the zone." [source]. These NS records are stored in the delegation set. For private zones, this does not happen, and so a delegation set object is not expected in the response.

[stof]

When testing that in localstack 3.0.0, it looks like the DelegationSet is now returned even for private zones. Is this expected ?