How do you create CAA records?

[Odiumediae]

G'day, everybody!

I'd like to know whether I've stumpled upon a bug or whether I'm simply doing something wrong (that's why I didn't create an issue right away).

I'm trying to create CAA records in order to get SLL-Zertificates from Let's Encrypt for a domain I've already set up on my DO-account. This works, when I do it manually, but it doesn't, when I'm using DigitalOcean Terraform Provider (v. 2.28.1).

The CAA iodef record gets planned, applied and destroyed correctly:

resource "digitalocean_record" "iodef" {
  type   = "CAA"
  domain = data.digitalocean_domain.web.id
  name   = "@"
  value  = "mailto:hostmaster@${var.domain_name}"
  tag    = "iodef"
  ttl    = 1800
  flags  = 0
}

issue and issuewild, however, get planned, as if nothing was wrong, but they don't work:

resource "digitalocean_record" "issue" {
  type   = "CAA"
  domain = data.digitalocean_domain.web.id
  name   = "@"
  value  = "letsencrypt.org"
  tag    = "issue"
  ttl    = 1800
  flags  = 0
}

resource "digitalocean_record" "issuewild" {
  type   = "CAA"
  domain = data.digitalocean_domain.web.id
  name   = "@"
  value  = "letsencrypt.org"
  tag    = "issuewild"
  ttl    = 1800
  flags  = 0
}

Terraform and the DO-API give me these errors instead:

╷
│ Error: Failed to create record: POST https://api.digitalocean.com/v2/domains/stopp.dev/records: 422 (request "ab8e7a96-82a6-4b93-80b6-7c04c1507bb6") Data needs to be a FQDN with issue or issuewild
│
│   with digitalocean_record.issue,
│   on records.tf line 39, in resource "digitalocean_record" "issue":
│   39: resource "digitalocean_record" "issue" {
│
╵
╷
│ Error: Failed to create record: POST https://api.digitalocean.com/v2/domains/stopp.dev/records: 422 (request "4ec37af7-1d93-44d8-8195-2e5c8bb6e927") Data needs to be a FQDN with issue or issuewild
│
│   with digitalocean_record.issuewild,
│   on records.tf line 50, in resource "digitalocean_record" "issuewild":
│   50: resource "digitalocean_record" "issuewild" {
│

It seems data is a property used in the DO-API, but it does not exist in the Provider properties. I've tried other values, applying the value with escaped extra-quotes and even superfluously setting the tag and flags in the value again, but nothing seems to stick.

Am I missing something or have I stumbled upon a bug?

[Odiumediae]

After hours on the wrong track, but of course only minutes after posting this, I've found the origin of the problem: me :)

Everything was correct, but I must have accidentally removed the A-record I was trying to point to. Since I could have sworn that I added it (which I did) and didn't remove it (which was wrong), I never even thought about looking for the A-record, until it dawned on me.

So, no bug there at all, just a confused user. Sorry for the fuss.

[Odiumediae]

Oh. Nope. It didn't work. It seems I'll have to create an issue after all.

[Hodgegoblin]

Adding this here for the next person on their quest.

Originally posted by @andrewsomething in #1010 (comment)

Hi @Odiumediae,

The data property in the API maps to the value field in the Terraform provider. It looks like the API expects a trailing dot (.) for the FQDN.

resource "digitalocean_record" "web_issue" {
  type   = "CAA"
  domain = data.digitalocean_domain.web.id
  name   = "@"
  value  = "letsencrypt.org."
  tag    = "issue"
  ttl    = 1800
  flags  = 0
}

resource "digitalocean_record" "web_issuewild" {
  type   = "CAA"
  domain = data.digitalocean_domain.web.id
  name   = "@"
  value  = "letsencrypt.org."
  tag    = "issuewild"
  ttl    = 1800
  flags  = 0
}