How can I use AWS RAM to share Route 53 Resolver rules across multiple VPCs and AWS accounts?

Resolution

Create the VPC Resolver rules

Before you begin, complete the following tasks:

• Review your VPC configurations. VPC Resolver is a Regional service. You can only share and associate VPCs in the same AWS Region where you create the rules.
• Review your permissions. You must have permissions to use the PutResolverRulePolicy action to share rules across AWS Accounts.

In Account A, create VPC Resolver rules to share with other accounts and VPCs.

Note: The account that your share rules with can't change or delete the share rule.

Share the VPC Resolver ules with AWS RAM

Complete the following steps:

1. Open the Route 53 console in Account A.
2. In the navigation pane, under VPC Resolver, choose Rules and select the rule that you want to share.
3. Choose Share. Then, enter the following information:
   For Name, enter a name for the resource share.
   For Select Resource Type, choose Resolver Rules.
   Select the Resolver Rule ID that you want to share. 
   Specify the Principal to share. The Principal can be a single account or an organization.
   (Optional) Add tags to the rule.

Accept the shared VPC Resolver rules in AWS RAM

Complete the following steps:

1. Open the AWS RAM console.
2. In the navigation pane, under Shared with me, choose Resource shares.
3. Select the resource share ID for the VPC Resolver rules.
4. Choose Accept resource share.

Associate the VPC Resolver rules with a VPC

Complete the following steps:

1. Open the Route 53 console in Account B.
2. In the navigation pane, under VPC Resolver, choose Rules and select the rule that you shared.
3. Choose Associate VPC.
4. Select the VPC, and then choose Add.

DNS queries from the VPC now use the outbound endpoint for the shared rule from Account A. AWS RAM manages connectivity between the VPC and the outbound endpoint for the rule from Account A.

Related information

Managing forwarding rules