Security Boundaries
Summary
Section titled “Summary”Classic VPC association affects the DNS control plane only. It is not network connectivity and not IAM cross-account access.
Read this section before Phase 2a.
Cross-account two-step contract
Section titled “Cross-account two-step contract”- Network_Account creates
VPCAssociationAuthorizationfor an exactvpc_id+vpc_region - VPC-owning account calls
AssociateVPCWithHostedZone
Same-account associations skip step 1.
What association grants
Section titled “What association grants”| Grants | Detail |
|---|---|
| DNS resolution | Associated VPCs resolve Platform_Zone records via the VPC resolver |
| Record control | Network_Account retains exclusive CRUD on record sets |
What association does not grant
Section titled “What association does not grant”| Does not grant | Detail |
|---|---|
| Network path | dig success does not mean traffic routes to record IP targets |
| IAM access | No cross-account role trust or resource access |
| Local PHZ copies | Workload accounts must not create duplicate private zones for the same domain |
Security properties of classic authorization
Section titled “Security properties of classic authorization”- Explicit allow-list — network authorizes specific VPC IDs; no account-wide associate permission
- Region-scoped —
vpc_regionon authorization must match the target VPC’s region - Auditable two-step — authorization and association are separate API calls with separate CloudTrail events
- Revocable — disassociate the VPC, then delete the authorization; resolution stops from that VPC
IAM permissions (reference)
Section titled “IAM permissions (reference)”The source demo uses SSO AdministratorAccess per account. For production, scope Route 53 actions per account role:
| Account | Typical Route 53 actions |
|---|---|
| Network (zone owner) | CreateVPCAssociationAuthorization, DeleteVPCAssociationAuthorization, ChangeResourceRecordSets, GetHostedZone, same-account associate/disassociate |
| Workload (VPC owner) | AssociateVPCWithHostedZone, DisassociateVPCFromHostedZone, ListHostedZonesByVPC |
The source demo does not ship custom Route 53 IAM policies.
Teardown security
Section titled “Teardown security”Route 53 rejects hosted zone deletion while cross-account associations exist. Follow Teardown order: disassociate workload VPCs before destroying the network stack.
Intentionally excluded (security hardening)
Section titled “Intentionally excluded (security hardening)”Out of demo scope but relevant at scale:
- Resolver query logging
- Route 53 DNS Firewall
- SCPs restricting
AssociateVPCWithHostedZoneto approved roles - Route 53 Profiles / RAM for centralised lifecycle management
See Why Classic for pattern tradeoffs.
Related pages
Section titled “Related pages”- Association Scenarios
- Pre-flight — before Phase 2a apply