How do I resolve cross-account Private Hosted Zones through Route 53 Global Resolver?

Overview

Route 53 Global Resolver DNS View Sharing enables cross-account PHZ resolution without transferring ownership of the hosted zone or the DNS view. The owner account keeps full control of the Global Resolver and DNS View, while the consumer account can make its private records resolvable through the owner's resolver, from any authorized client location.

Prior to this feature, attempting cross-account PHZ association returned GR-ERR03603 (ResourceNotFoundException) or GR-ERR03102 (ValidationException). DNS View Sharing via RAM eliminates these errors.

How DNS View Sharing works

Two accounts are involved:

• Owner account: Owns the Global Resolver and DNS View. Shares the DNS View via RAM and chooses what permissions to grant.
• Consumer account: Owns the Private Hosted Zone. Accepts the RAM share and associates its PHZ to the shared DNS View.

Once associated, queries to the consumer's private domains through the owner's Global Resolver resolve correctly, from any authorized client, in any Region where the resolver runs.

The owner can see and remove consumer-created associations at any time. The consumer can manage only the associations it created.

RAM permission levels

When sharing a DNS View, the owner selects a managed permission that defines what the consumer can do:

• AWSRAMDefaultPermissionDNSView (default): Consumer can view the shared DNS View and associate/disassociate its own PHZs. Actions: AssociateHostedZone, GetDNSView.

• AWSRAMPermissionDNSViewLifecycleManagement: Consumer can view, update, enable, and disable the DNS View, but cannot associate PHZs.

• AWSRAMPermissionDNSViewFullAccess: Consumer can associate PHZs and manage the lifecycle of the DNS View.

Important considerations

• PHZ associations created by the consumer are owned by the consumer's account but count toward the owner's quota for associations per DNS View.

• The consumer's PHZ does NOT need a VPC association when used with Global Resolver.

• If the owner stops sharing (unshares) the DNS View, existing PHZ associations are NOT removed automatically, they continue to affect resolution until explicitly deleted.

• The owner cannot delete a DNS View while it's shared. Stop sharing first, then delete.

• The owner's Global Resolver may run in opt-in Regions the consumer hasn't enabled. The PHZ domain name is replicated to all Regions where the resolver runs.

• No additional cost for DNS View sharing.

Note on Regions: Route 53 Global Resolver operations (create resolver, create DNS view, associate hosted zone) use --region us-east-2 (Ohio). However, the RAM resource share for a DNS View must be created in --region us-east-1 (N. Virginia), because the DNS View is treated as a global resource by RAM. This distinction is easy to miss, using Ohio for the RAM share returns MalformedArnException.

Getting started

Prerequisites

• A Route 53 Global Resolver (OPERATIONAL) in the owner account

• A DNS View configured in the owner account

• A Private Hosted Zone in the consumer account

• AWS RAM enabled in both accounts (via Organizations or standalone)

• IAM permissions: AmazonRoute53GlobalResolverFullAccess in the owner account, ram:AcceptResourceShareInvitation + route53globalresolver:AssociateHostedZone in the consumer account

Step 1: Owner account — Share the DNS View via AWS RAM

Create a resource share targeting the consumer account. Note: use --region us-east-1 (Virginia), not Ohio.

aws ram create-resource-share \
  --region us-east-1 \
  --name shared-dns-view-team-b \
  --resource-arns "arn:aws:route53globalresolver::OWNER_ACCOUNT_ID:dns-view/dnsv-0a1b2c3d4e5f67890" \
  --principals "CONSUMER_ACCOUNT_ID"

This uses the default permission (AWSRAMDefaultPermissionDNSView) which allows the consumer to associate PHZs. To specify a different permission level, add --permission-arns with the desired managed permission ARN.

Step 2: Consumer account — Accept the RAM resource share

If both accounts are in the same AWS Organization with RAM sharing enabled, acceptance is automatic — skip this step.

For accounts outside the Organization, the consumer must accept the invitation:

aws ram accept-resource-share-invitation \
  --resource-share-invitation-arn "arn:aws:ram:us-east-1:OWNER_ACCOUNT_ID:resource-share-invitation/INVITATION_ID" \
  --region us-east-1

Step 3: Consumer account — Associate PHZ to the shared DNS View

The consumer associates its own PHZ to the owner's DNS View. This command uses --region us-east-2 (Global Resolver control plane).

aws route53globalresolver associate-hosted-zone \
  --hosted-zone-id Z00a1b2c3d4e5f67890 \
  --resource-arn "arn:aws:route53globalresolver::OWNER_ACCOUNT_ID:dns-view/dnsv-0a1b2c3d4e5f67890" \
  --name "team-b-internal-phz" \
  --region us-east-2

Step 4: Verify resolution

From an authorized client (Access Source or Access Token), query a record from the consumer's PHZ:

dig @ANYCAST_IP app.teamb.internal.example.com

Expected: the A record from the consumer's PHZ is returned. If the client is not authorized, the resolver returns REFUSED.

Troubleshooting

If you attempt cross-account PHZ association without DNS View Sharing, you will encounter these errors:

• GR-ERR03603 ResourceNotFoundException: "Error validating hosted zone." The associate-hosted-zone API only looks for PHZs within the caller's account. The PHZ exists in a different account.

• GR-ERR03102 ValidationException: "Unable to associate hosted zone." The caller owns the PHZ but cannot target a DNS View ARN in a different account without a RAM share in place.

• MalformedArnException: You cannot share the selected resource type: You are creating the RAM share in the wrong Region. DNS View shares must be created in us-east-1 (Virginia), not us-east-2 (Ohio).

All errors are resolved by completing Steps 1-3 above with the correct Regions.

Key takeaways

• Cross-account PHZ resolution through Global Resolver requires DNS View Sharing via AWS RAM.

• The owner shares the DNS View; the consumer accepts and associates its PHZs.

• The owner retains full control, can remove associations or stop sharing at any time.

• Consumer PHZ associations count toward the owner's quota.

• No VPC association needed for PHZs used with Global Resolver.

• No additional cost for sharing.

• RAM share goes in us-east-1 (Virginia); Global Resolver operations go in us-east-2 (Ohio). Mixing them up causes MalformedArnException.

Related information

[1] Sharing Route 53 Global Resolver DNS views between AWS accounts

[2] Configuring private hosted zone associations

[3] Amazon Route 53 Global Resolver now supports sharing DNS Views between AWS Accounts (What's New)

[4] What is Route 53 Global Resolver

[5] AWS RAM User Guide

[6] AWS::Route53GlobalResolver::GlobalResolver (CloudFormation)