Association Scenarios
Four scenarios
Section titled “Four scenarios”The source demo covers every combination Route 53 classic auth supports:
| # | Scenario | Example | Authorization required? | Who creates association |
|---|---|---|---|---|
| 1 | Cross-account, same region | dev-apse2 | Yes | Dev_Account |
| 2 | Cross-account, cross-region | dev-apse6 | Yes (vpc_region = ap-southeast-6) | Dev_Account |
| 3 | Same-account, cross-region | network-apse6 | No | Network_Account |
| 4 | Same-account, same region (2nd VPC) | network secondary | No | Network_Account (with PHZ) |
Cross-account flows always require two parties: network authorizes in Phase 2a, workload associates in Phase 3. Same-account flows skip authorization.
Decision flow
Section titled “Decision flow”Prerequisites checklist
Section titled “Prerequisites checklist”| Requirement | Cross-account | Same-account | Demo reference |
|---|---|---|---|
PHZ exists (zone_id valid) | Yes | Yes | Phase 2a zone_id output |
| Target VPC exists | Yes | Yes | Phase 1 vpc_id per stack |
vpc_region matches VPC region | Yes | Yes | cross-account-auth module |
VPCAssociationAuthorization for exact vpc_id | Yes | No | Phase 2a — network stack |
AssociateVPCWithHostedZone in VPC account | Yes | Yes | Phase 2b / Phase 3 |
| VPC DNS support and hostnames enabled | Yes | Yes | VPC module defaults |
Two-party operations
Section titled “Two-party operations”| Action | API | Who | Demo phase |
|---|---|---|---|
| Create authorization | CreateVPCAssociationAuthorization | Network_Account | 2a |
| Associate VPC | AssociateVPCWithHostedZone | VPC-owning account | 2b / 3 |
| Disassociate VPC | DisassociateVPCFromHostedZone | VPC-owning account | Teardown Step 1 |
| Delete authorization | DeleteVPCAssociationAuthorization | Network_Account | network destroy |
| Delete PHZ | DeleteHostedZone | Network_Account | After all cross-account associations removed |
Terraform resources in the source demo:
aws_route53_vpc_association_authorization—cross-account-authmoduleaws_route53_zone_association— workload stacks andnetwork-apse6aws_route53_zone+ primary VPC block —private-hosted-zonemodule
Common failure modes
Section titled “Common failure modes”| Symptom | Likely cause |
|---|---|
AccessDenied on associate | Missing or stale authorization |
AccessDenied cross-region | Wrong vpc_region on authorization |
Step A OK, Step B empty dig | Propagation delay or association drift |
See Troubleshooting for step-by-step fixes.