Skip to content
Amazon Route 53 Classic Multi-Account Walkthrough

Why Classic

What “classic” means

Section titled “What “classic” means”

Classic means the native Route 53
Amazon Route 53 — hosts the shared Platform_Zone; classic VPC association authorization lets workload VPCs resolve the same private records. VPC association authorization
CreateVPCAssociationAuthorization — network account permits a specific VPC (id + region) in another account to associate with the PHZ. APIs:

  1. The zone owner creates a VPC_Association_Authorization
    CreateVPCAssociationAuthorization — network account permits a specific VPC (id + region) in another account to associate with the PHZ.     for a specific VPC ID and region.
  2. The VPC owner creates a VPC_Association
    AssociateVPCWithHostedZone — workload account links its VPC to an authorized private hosted zone so the VPC resolver can query shared records.     to link that VPC to the authorized private hosted zone.

The contract is explicit, API-visible, and does not depend on Route 53 Profiles
Centralised Route 53 association lifecycle — alternative to classic authorization; not used in this walkthrough. or AWS RAM
AWS Resource Access Manager — can share hosted zones; not part of this classic pattern..

Why this demo uses classic

Section titled “Why this demo uses classic”
  • Teaches the underlying Route 53 sharing contract as separate, auditable steps
  • One Platform_Zone
    Shared private hosted zone `platform.demo.local` in the Network_Account — the only place `api` and `db` records are defined.     in the Network_Account
    AWS account that owns Platform_Zone, DNS records, and cross-account VPC_Association_Authorization resources.     serves all regions
  • DNS records stay in one authoritative place — workload accounts resolve but do not author records
  • Simple to understand and operate — no Profiles, RAM, or extra shared-services layer; you pay for Route 53 and VPCs you already use

When classic may not be best for production

Section titled “When classic may not be best for production”
ConsiderationClassic behavior
Lifecycle managementManual two-party operations; Profiles/RAM centralise association lifecycle
Authorization bindingAuthorization_Specificity — exact vpc_id + vpc_region; VPC recreate requires re-authorization
Operations modelNetwork authorizes; workload associates — separate accounts, separate applies
Cross-stack couplingManual Cross_Stack_Handoff of vpc_id and zone_id via terraform.tfvars
Zone ownershipSingle Platform_Zone owner concentrates DNS control-plane responsibility

Stance: classic fits this learning demo — not every greenfield design. Considerations like Authorization_Specificity
Each authorization binds to exact `vpc_id` and `vpc_region` — recreated VPCs need re-authorization in Phase 2a. and manual Cross_Stack_Handoff
Manual passing of Phase 1 `vpc_id` outputs and Phase 2a `zone_id` into later stacks via `terraform.tfvars`. matter in production. See Limitations and Intentionally excluded.

Alternatives not used here

Section titled “Alternatives not used here”
  • Route 53 Profiles — centralised association lifecycle; different setup and ownership model
  • AWS RAM — resource sharing for hosted zones; not part of this walkthrough

Next steps

Section titled “Next steps”