Skip to content
Amazon Route 53 Classic Multi-Account Walkthrough

Route 53 Classic Multi-Account Walkthrough

Share one Route 53 private hosted zone across three AWS accounts and two regions — classic VPC association authorization, no Profiles or RAM
Get Started View on GitHub

What you’ll build

Section titled “What you’ll build”

Share one private zone

A single Platform_Zone
Shared private hosted zone `platform.demo.local` in the Network_Account — the only place `api` and `db` records are defined. in the network account — dev and sandbox VPCs resolve the same records with no local PHZ copies, spanning cross-account
Dev and sandbox VPCs in separate AWS accounts associate with one network-owned PHZ after explicit authorization. and cross-region
VPCs in ap-southeast-6 associate with a PHZ in ap-southeast-2 — Route 53 resolves shared records across regions from one zone. associations.

Authorize and associate

The classic Route 53
Amazon Route 53 — hosts the shared Platform_Zone; classic VPC association authorization lets workload VPCs resolve the same private records. sharing contract:

VPC association authorization
CreateVPCAssociationAuthorization — network account permits a specific VPC (id + region) in another account to associate with the PHZ.

in the zone owner, then VPC association
AssociateVPCWithHostedZone — workload account links its VPC to an authorized private hosted zone so the VPC resolver can query shared records. in the workload account — four association scenarios
One of four demo paths: cross-account same-region, cross-account cross-region, same-account cross-region, or same-account same-region. in one demo.

Prove shared resolution

Every associated VPC — owner, cross-account, and cross-region — resolves api.platform.demo.local from the same shared PHZ
Private Hosted Zone — resolves DNS only from associated VPCs. This demo uses one authoritative PHZ in the network account. records, proving Route 53
Amazon Route 53 — hosts the shared Platform_Zone; classic VPC association authorization lets workload VPCs resolve the same private records. sharing end to end.

Understand the pattern

When classic PHZ sharing fits, what association does and does not grant, and why this walkthrough uses authorization APIs instead of Route 53 Profiles or RAM.