amazon-web-servicesdnssubdomainamazon-route53

AWS Route53 - different AWS accounts with same hosting zone name


I'd like to understand better what would happen in the following scenarios:

  1. If there are 2 AWS accounts and both of them have example.com hosting zone each, account one has prod.example.com and account two has dev.example.com, will they resolve correcly?
  2. If aws account one and two have example.com hosting zone, I delete record good.example.com and than create same record in account two but good.example.com pointing to a different endpoint (i.e. different Load Balancer), will this resolve correctly?
  3. If I have existing example.com hosting zone, will creating example.com in another aws account screw up the first one?
  4. If I have existing example.com public hosting zone, will creating private example.com in another aws account screw up the first one? Is it even possible? In this case, I'd like to have domains like internal.example.com in private one.
  5. Will having public and private hosted zone with same name work in same AWS account?

I wish I could test these scenarios but I don't want to bomb production:) Thank you.


Solution

  • Only one AWS account can have a working example.com public hosted zone in Route53. Only one Route53 public hosted zone can be configured as the authoritative DNS server with the domain registrar. Please see how DNS works. A DNS record lookup is going to go only to the authoritative DNS server for that domain. None of the other DNS servers (Route53 public hosted zones) you have configured will ever get the DNS lookup request.

    If you need other accounts to control subdomains of the main domain, like prod.example.com and dev.example.com, then you would have to setup DNS delegation. In that setup you would still only have one account with a working example.com Route53 public hosted zone, but for any requests for prod.example.com or *.prod.example.com DNS records, that Route53 hosted zone would delegate the DNS lookup to the public hosted zone in the other account.


    If I have existing example.com public hosting zone, will creating private example.com in another aws account screw up the first one? Is it even possible? In this case, I'd like to have domains like internal.example.com in private one.

    Private hosted zones are different. Private hosted zones must be attached to a VPC (or multiple VPCs). Private hosted zones are never configured with your domain registrar, and are not resolvable on the public Internet. The DNS lookups for private hosted zones only work inside the VPCs they are attached to. Creating private hosted zones does not interfere with the public hosted zone at all. It will not "screw up" the public DNS resolution of the domain in any way.

    Will having public and private hosted zone with same name work in same AWS account?

    Yes absolutely. The public hosted zone will be the only one configured with your domain registrar. As far as public DNS queries on the Internet are concerned, the public hosted zone is the only DNS server for your domain. Only your software performing DNS lookups inside your private VPCs will be able to see the private hosted zone records.

    Note that private hosted zones don't even have to be for domain names that you own. They can be completely made-up domain names, like internal.mydomain. They don't even need to have a valid Internet TLD (Top Level Domain) because they are not "on the Internet".