feat(route53): support failover routing policy for record sets

[0xdsqr]

Issue # (if applicable)

Closes #35910

---

Reason for this change

The L1 CfnRecordSet supports the Failover property, allowing users to define PRIMARY and SECONDARY record sets for Route 53 failover routing policies. However, this capability was not exposed at the L2 RecordSet level.
This enhancement introduces first-class support for failover routing in the L2 construct, simplifying configuration and validation for high-availability DNS setups.

Before (L1 override):

const record = new route53.ARecord(this, 'ARecord', {
  zone,
  target: route53.RecordTarget.fromAlias(
    new
  )
});
const cfnRecord = record.node.defaultChild as route53.CfnRecordSet;
cfnRecord.addPropertyOverride('Failover', 'PRIMARY');

After (L2 support):

new route53.ARecord(this, 'ARecord', {
  zone,
  target: route53.RecordTarget.fromIpAddresses('1.2.3.4'),
  healthCheck: myHealthCheck,
  failover: route53.Failover.PRIMARY,
});

Description of changes

• Added failover?: 'PRIMARY' | 'SECONDARY' to RecordSetProps and RecordSetOptions. . Enables users to define primary and secondary record sets directly in the L2 construct.
• Propagated failover to the synthesized CloudFormation template via CfnRecordSet.Failover.
• Added validation rules:
  • Prevent combining failover with other routing policies (region, weight, geoLocation, multiValueAnswer, or cidrRoutingConfig).
  • Warn when a PRIMARY failover record set does not specify a healthCheck.
  • For alias records with failover, automatically warn if EvaluateTargetHealth is not set to true, aligning with Route 53 best practices.
• Enhanced setIdentifier generation:
  Automatically derives a deterministic identifier prefix (FAILOVER_PRIMARY_ID_ / FAILOVER_SECONDARY_ID_) for failover record sets.
• Added new unit tests validating:
  • Proper synthesis of Failover and HealthCheckId fields.
  • Expected behavior and warnings for missing health checks.
  • Alias target warnings for missing EvaluateTargetHealth.
  • Error handling when failover is combined with other routing policies.

This aligns with Route 53’s documented behavior:

When the primary record set is unhealthy and the secondary is healthy, Route 53 responds using the secondary record.
If the primary is healthy, Route 53 always prefers it. Alias failover records require EvaluateTargetHealth = true.

Reference: Amazon Route 53 Developer Guide — Failover Routing

Describe any new or updated permissions being added

None — this change only affects construct synthesis and validation logic.

Description of how you validated changes

• Added comprehensive unit tests in record-set.test.ts.
• Validated synthesized CloudFormation output for both PRIMARY and SECONDARY failover configurations.
• Manually deployed a sample stack containing paired failover records and confirmed expected Route 53 behavior and DNS failover switching.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

[badmintoncryer]

Thank you for your contribution! I've added some minor comments.

[badmintoncryer]

Could you please execute integ test and add snapshot files?

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[pahud]

Hi @0xdsqr

I am seeing this unit test failing in the CI error log

aws-cdk-lib: FAIL aws-route53/test/record-set.test.ts (21.023 s)
aws-cdk-lib:   ● record set › does not warn when failover alias target sets EvaluateTargetHealth=true
aws-cdk-lib:     TypeError: assertions_1.Annotations.fromStack(...).hasNoWarnings is not a function
aws-cdk-lib:       1922 |
aws-cdk-lib:       1923 |     // THEN
aws-cdk-lib:     > 1924 |     Annotations.fromStack(stack).hasNoWarnings();
aws-cdk-lib:            |                                  ^
aws-cdk-lib:       1925 |   });
aws-cdk-lib:       1926 |
aws-cdk-lib:       1927 |   test('throws when failover is combined with another routing policy', () => {
aws-cdk-lib:       at Object.<anonymous> (aws-route53/test/record-set.test.ts:1924:34)

I think you probably want to run yarn test locally in aws-route53 directory to check that error.

[pahud]

Looks like CodeBuild CI passed now. It's all set from contributor's perspective. I'll bring this up to the team ASAP. Feel free to tag me if you need my attention.

[0xdsqr]

Hey @pahud realize this week is busy, but I still do have an interest in getting this merged. Any idea on if team will consider to ship this?

[pahud]

@0xdsqr Sure! I’ll bring this up to the team tomorrow. Will get back to you ASAP.

[alvazjor]

@0xdsqr Thanks for the contribution. Added some comments that need to be addressed before we can merge this in

Pull request has been modified.

[mergify]

Merge Queue Status

🚫 The pull request has left the queue (rule: default-squash)

This pull request spent 4 seconds in the queue, with no time running CI.

Reason

The pull request can't be updated

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/analytics-metadata-updater.yml without workflows permission

Hint

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

[github-actions]

	Tests	Passed ❌️	Skipped	Failed
Security Guardian Results	0 ran	0 passed	0 skipped	0 failed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

	Tests	Passed ❌️	Skipped	Failed
Security Guardian Results with resolved templates	0 ran	0 passed	0 skipped	0 failed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[mergify]

Merge Queue Status

✅ The pull request has been merged

This pull request spent 25 seconds in the queue, including 1 second running CI.
The checks were run in-place.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat(route53): support failover routing policy for record sets #35909
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • feat(route53): support failover routing policy for record sets #35909
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.