How do I configure and manage cross-account access for Amazon Route 53 resources?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To set up cross-account access, create a central DNS account and at least one member account. The central DNS account hosts your primary Amazon Route 53 configuration, manages private hosted zones, and controls Route 53 Resolver endpoints. Member accounts contain resources that require access to DNS services from the central account. For example, a resource in a member account might require DNS resolution for records in a private hosted zone in a central account.

Set up the accounts

Complete the following steps in the central and member accounts to set up forwarding:

1. In the central account, run the following create-hosted-zone command to create a private hosted zone with records:

   aws route53 create-hosted-zone \  
     --name example.internal \  
     --vpc VPCRegion=us-east-1,VPCId=vpc-xxxxx \  
     --caller-reference $(date +%s)

   Note: Replace example.internal with your hosted zone name and replace vpc-xxxxx with your VPCId.
2. In the central account, run the following create-resolver-endpoint command to create an inbound endpoint:

   aws route53resolver create-resolver-endpoint \  
     --creator-request-id inbound-endpoint \  
     --direction INBOUND \  
     --ip-addresses \  
        SubnetId=subnet-xxxxx,Ip=10.0.0.10 \  
        SubnetId=subnet-yyyyy,Ip=10.0.1.10 \  
     --security-group-ids sg-xxxxx

   Note: Replace subnet-xxxxx and subnet-yyyyy with your SubnetIDs, replace 10.0.0.10 and 10.0.1.10 with your IP addresses, and replace sg-xxxxx with your security-group-id.
3. In the member account, run the following create-resolver-endpoint command to create an outbound endpoint:

   aws route53resolver create-resolver-endpoint \  
     --creator-request-id outbound-endpoint \  
     --direction OUTBOUND \  
     --ip-addresses \  
        SubnetId=subnet-xxxxx \  
        SubnetId=subnet-yyyyy \  
     --security-group-ids sg-yyyyy

   Note: Replace subnet-xxxxx and subnet-yyyyy with your SubnetIDs and replace sg-xxxxx with your security-group-id.
4. In the member account, run the following create-resolver-rule command to create an outbound Resolver rule: 

   aws route53resolver create-resolver-rule \  
     --creator-request-id rule1 \  
     --domain-name example.internal \  
     --rule-type FORWARD \  
     --resolver-endpoint-id rslvr-endpoint-id \  
     --target-ips Ip=10.0.0.10

   Note: Replace rule1 with your rule name, replace example.internal with your hosted zone name, replace rslvr-endpoint-id with your resolver-endpoint-id, and replace 10.0.0.10 with your IP address.

Use an Amazon Route 53 Profile to share resources

You can also use an Amazon Route 53 Profile to share your private hosted zone or outbound Resolver rules. 

Complete the following steps:

1. Create a Route 53 Profile in the central account.
2. Associate your private hosted zone or Resolver rule with your Route 53 Profile.
3. Use AWS Resource Access Manager (AWS RAM) to share the Route 53 Profile with your member account.
4. Associate your Amazon VPC to the Route 53 Profile that's in your member account.

Use Amazon VPC to share resources

You can allow Amazon Virtual Private Cloud (Amazon VPC) resources in a member account to access private hosted zone records in your central account. 

Complete the following steps:

1. Create a private hosted zone in the central account.
2. Associate the private hosted zone with an Amazon VPC in the member account.

Use AWS RAM to share Resolver rules and AWS resources

You can use AWS RAM to share Resolver rules and AWS resources from your central account.

You can also share Resolver rules across multiple accounts that are part of AWS Organizations or in an organizational unit (OU). Instead of an enumeration of each account, use AWS RAM to share an outbound Resolver rule with AWS Organizations.

Complete the following steps in your central account:

1. Run the following enable-sharing-with-aws-organization to set up AWS RAM:

   aws ram enable-sharing-with-aws-organization

2. Run the following create-resource-share command to create a resource share for your Resolver rule:

   aws ram create-resource-share \  
     --name "dns-share" \  
     --resource-arns arn:aws:route53resolver:region:account-id:resolver-rule/resolver-rule  
     --principals arn:aws:organizations::account-id:organization/o-xxxxxxxxxx

   Note: Replace dns-share with your resource share name, replace region with your region, replace account-id with your account-id, replace resolver-rule with your resolver rule, and replace o-xxxxxxxxxx with your organization.

Associate an outbound Resolver rule with a VPC in your member account

Complete the following steps:

1. Open the Route 53 console.
2. In the navigation pane, choose Rules.
3. Choose the AWS Region where you created the rule.
4. Select the rule that you want to associate with a VPC.
5. Choose Associate VPC.
6. Under VPCs that use this rule, select the VPC.
7. Choose Add.