I want to associate my Amazon Route 53 private hosted zone with an Amazon Virtual Private Cloud (VPC) that belongs to a different AWS account. How can I do this?

To associate a Route 53 private hosted zone in one AWS account (Account A) with a VPC that belongs to another AWS account (Account B), follow these steps using the AWS Command Line Interface (AWS CLI):

Note: You can also use the AWS SDK or Amazon Route 53 API for this procedure.

1.    Connect to an EC2 instance in Account A.

2.    Run the following commands to update the AWS CLI version. Note: Be sure that the AWS CLI is configured to use the credentials of an IAM user that has Route 53 access.

aws –-versionpip install --upgrade awscli

3.    Run this command to list the available hosted zones in Account A. Note the hosted zone ID in Account A that you will associate with Account B.  

aws route53 list-hosted-zones

4.    Run the following command to authorize the association between the private hosted zone in Account A and the VPC in Account B. Note: Use the hosted zone ID from the previous step, as well as the region and ID of the VPC in Account B.  

aws route53 create-vpc-association-authorization --hosted-zone-id <hosted-zone-id> --vpc VPCRegion=<region>,VPCId=<vpc-id>

5.    Connect to an EC2 instance in Account B.

6.    Run the following command to create the association between the private hosted zone in Account A and the VPC in Account B. Note: Use the hosted zone ID from step #3, as well as the region and ID of the VPC in Account B.

aws route53 associate-vpc-with-hosted-zone --hosted-zone-id <hosted-zone-id> --vpc VPCRegion=<region>,VPCId=<vpc-id>

7.    We recommend that you delete the association authorization after the association is created. Doing this prevents you from recreating the same association later. To delete the authorization, reconnect to an EC2 instance in Account A. Then, run this command:  

aws route53 delete-vpc-association-authorization --hosted-zone-id <hosted-zone-id>  --vpc VPCRegion=<region>,VPCId=<vpc-id>

EC2 instances in the VPC from Account B can now resolve records in the private hosted zone in Account A.  


Did this page help you? Yes | No

Back to the AWS Support Knowledge Center

Need help? Visit the AWS Support Center

Published: 2016-12-27

Updated: 2018-03-21