Install and configure systemd-resolved

[jsf9k]

🗣 Description

This pull request modifies the AMI to use the stub DNS resolver from systemd-resolved. See also cisagov/ansible-role-systemd-resolved#1.

💭 Motivation and context

This PR resolves cisagov/cool-system-internal#140.

🧪 Testing

All automated tests pass.

I also built a staging AMI from these changes and tweaked the cisagov/cool-assessment-terraform code to use this AMI when deploying Debian Desktop instances. In this way I was able to verify that this AMI indeed uses the systemd-resolved stub DNS resolver by default for both UDP and TCP requests:

ssm-user@debiandesktop0:/usr/bin$ dig www.yahoo.com

; <<>> DiG 9.18.24-1-Debian <<>> www.yahoo.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10251
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;www.yahoo.com.                 IN      A

;; ANSWER SECTION:
www.yahoo.com.          1       IN      CNAME   me-ycpi-cf-www.g06.yahoodns.net.
me-ycpi-cf-www.g06.yahoodns.net. 1 IN   A       69.147.92.12
me-ycpi-cf-www.g06.yahoodns.net. 1 IN   A       69.147.92.11

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed May 01 16:02:31 UTC 2024
;; MSG SIZE  rcvd: 119

ssm-user@debiandesktop0:/usr/bin$ dig +tcp www.yahoo.com

; <<>> DiG 9.18.24-1-Debian <<>> +tcp www.yahoo.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19082
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;www.yahoo.com.                 IN      A

;; ANSWER SECTION:
www.yahoo.com.          11      IN      CNAME   me-ycpi-cf-www.g06.yahoodns.net.
me-ycpi-cf-www.g06.yahoodns.net. 11 IN  A       69.147.92.11
me-ycpi-cf-www.g06.yahoodns.net. 11 IN  A       69.147.92.12

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (TCP)
;; WHEN: Wed May 01 16:02:22 UTC 2024
;; MSG SIZE  rcvd: 119

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.
• Build and test a prerelease AMI with these changes.

✅ Pre-merge checklist

• Revert to using the default branch of cisagov/ansible-role-systemd-resolved once First commits for an Ansible role to install and configure systemd-resolved ansible-role-systemd-resolved#1 is merged.
• Finalize version.

✅ Post-merge checklist

• Create a release.

[dav3r]

Strong work! 💪 💼

[mcdonnnj]