feat(terraform): move A record for CDN to private zone

[JoshuaLicense]

Description

Moves the CDN to behind the VPN. Moves the A record to the private zone.

Related issue: https://dvsa.atlassian.net/browse/VOL-5380

Before submitting (or marking as "ready for review")

• Does the pull request title follow the conventional commit specification?
• Have you performed a self-review of the code
• Have you have added tests that prove the fix or feature is effective and working
• Did you make sure to update any documentation relating to this change?

[github-actions]

Terraform plan for environment: int

Commit: 84a3b25

API version: 878c50d
Selfserve version: 8619453
Internal version: 45f7dab

Plan summary

0 to add, 0 to change, 0 to destroy

---

Show full plan

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

Terraform plan for environment: dev

Commit: 84a3b25

API version: 878c50d
Selfserve version: 8619453
Internal version: 45f7dab

Plan summary

0 to add, 0 to change, 2 to destroy

🗑️ Deletes

module.service.module.private_records.aws_route53_record.this["cdn A"]
module.service.module.records.aws_route53_record.this["cdn A"]

---

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  - destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.service.module.private_records.aws_route53_record.this["cdn A"] will be destroyed
  # (because aws_route53_record.this is not in configuration)
  - resource "aws_route53_record" "this" {
      - allow_overwrite                  = false -> null
      - fqdn                             = "cdn.dev.olcs.dev-dvsacloud.uk" -> null
      - id                               = "Z06327482M90P8E4J6Z9P_cdn.dev.olcs.dev-dvsacloud.uk_A" -> null
      - multivalue_answer_routing_policy = false -> null
      - name                             = "cdn.dev.olcs.dev-dvsacloud.uk" -> null
      - records                          = [] -> null
      - ttl                              = 0 -> null
      - type                             = "A" -> null
      - zone_id                          = "Z06327482M90P8E4J6Z9P" -> null
        # (2 unchanged attributes hidden)

      - alias {
          - evaluate_target_health = false -> null
          - name                   = "d23zgifomtl7hu.cloudfront.net" -> null
          - zone_id                = "Z2FDTNDATAQYW2" -> null
        }
    }

  # module.service.module.records.aws_route53_record.this["cdn A"] must be replaced
-/+ resource "aws_route53_record" "this" {
      ~ fqdn                             = "cdn.dev.olcs.dev-dvsacloud.uk" -> (known after apply)
      ~ id                               = "Z086652433MVY3YKRJJ6T_cdn.dev.olcs.dev-dvsacloud.uk_A" -> (known after apply)
      - multivalue_answer_routing_policy = false -> null
        name                             = "cdn.dev.olcs.dev-dvsacloud.uk"
      - records                          = [] -> null
      - ttl                              = 0 -> null
      ~ zone_id                          = "Z086652433MVY3YKRJJ6T" -> "Z06327482M90P8E4J6Z9P" # forces replacement
        # (4 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 0 to change, 2 to destroy.