EKS collector custom domain - Snowplow-managed DNS, ACM certificate

Last updated: September 3, 2026

Snowplow owns the Route53 zone and the certificate. Nothing is required from the customer.

Start at EKS collector custom domains overview if you are not sure this is the right path.

This is the default path for a custom collector domain. Use it whenever the domain's zone is delegated to the customer's Snowplow AWS account.

Consul keys

customer/<client>/aws_rt_pipeline_<env>/input/collector/dns/delegated_ack_managed_domains

Both are comma-separated lists of fully qualified domain names. Default is empty.

Key

Effect

delegated_ack_managed_domains

Same, and points the Route53 record at the NLB IPs.

Steps

  1. Confirm the zone is delegated. It must appear in the customer's aws_account stack, either as a
    Snowplow-created subdomain zone or as a pre-existing customer zone in the same account. If the
    zone is missing, the apply fails when it tries to find it.

  2. Add the domain to collector/dns/delegated_ack_managed_domains.

  3. Apply aws_rt_pipeline with the stacks/deploy handler.

The apply requests the ACM certificate, and the DNS-01 validation record is created automatically. The Route53 record for the domain is written as an A record pointing at the static NLB IPs, with a 60 second TTL.

Common failures

Message contains

Cause

collector_nlb_ips is empty

The aws_eks_namespace stack has not published the NLB IPs. Reapply it, then retry.

are in BOTH ... staging ... and ...

The domain is in the staging key and the final key. Remove the staging entry.

appear in BOTH the delegated and external

The domain is also in an external_* key. Pick one.

appear in BOTH an ack-managed key and an imported-cert key

The domain is also in an imported-cert map. Pick one certificate source.