Grant permission to different account to update Route53

Question

I have a nodejs script that builds a whole application infrastructure for new accounts in my organisation. The new hosts, api gateway, buckets etc. are within the new account, but the DNS records for these need to be in the account that administers the parent zone.

How can I grant federated access to a different account to allow them to create new public hosted zones as well as NS/SOA/A/CNAME records in the parent zone?

I've read loads about it but can't decide if it's actually possible ...

Accepted Answer

OK, I figured out Step 6: I don't have to "switch back", I need two Route53 clients, one with the original credentials to update my subdomain, and a second one to update the parent domain, configured with the credentials returned from the assumeRole() call.

BTW there was an AWS bug I had to work around in Step 4. Following https://github.com/aws/aws-sdk-js-v3/issues/3940 I changed my code that returns a service client for Route53 in the parent account like this:

``` 
async getParentRoute53Client()
 {   
        try {
            let roleArn = `arn:aws:iam:::role/`;
            
            let response = await this.#stsClient.send(new AssumeRoleCommand({
                                        RoleArn: roleArn,
                                        RoleSessionName: '',
                                        DurationSeconds: 900
                                }));

// can't use the Credentials returned from the response directly as there's a bug: https://github.com/aws/aws-sdk-js-v3/issues/3940

I can then use the 
```
parentRoute53Client
```
 to make changes in the parent domain.

And breathe :D:D

Answer

I thought I'd add an update in case it helps anyone in the same predicament in the future :)

I solved Step 4 by:
* creating an IAM ***role*** with AmazonRoute53DomainsFullAccess permission in Account A, using the Account ID for Account B to set up the trusted entity
* creating an IAM ***user*** in Account B (without access to the AWS Console)
* putting the security credentials for the Account B user in a shared credentials file so that Steps 1-3 of my program run as this user.

Once Step 3 is complete, I ```stsClient.assumeRole()``` using the Arn for the IAM role Account A to complete Step 4.

This lets me complete Step 5.

Now I need to figure out Step 6 :)

Answer

While you can do this with IAM roles, I would consider creating a subdomain into each account R53. Advantages of this are you ...

* can use normal ways to deploy DNS records (vs assuming role first)
* can automatically deploy records for ACM cert validation
* don't have to provide each application owner a full access to your DNS but only for the records in their own subdomain.

Here are simple instructions how to do this.

https://repost.aws/knowledge-center/create-subdomain-route-53

Note that your parent domain (example.com) and subdomain (myapp.example.com) don't need to be on the same account.

Answer

Hello.

Wouldn't it be a good idea to allow the IAM user to switch roles to an account in the parent domain?  
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html

If you have multiple accounts, it may be a good idea to use AWS Organizations to manage users with IAM Identity Center.  
https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

Answer

If possible I'd really appreciate a bit of help with this ... I've been reading so many docs I've gotten myself properly confused :) It almost makes sense, then it slips away again, and though I've tried many combinations I haven't worked out the correct combination of users/roles/permissions/policies.

To recap, I now have Account A which holds the parent zone records for example.com, and I want to programatically create subdomain acme.example.com in Account B.

Both accounts are in the same Organization if that's relevant - I think I should just use IAM for the users rather than IIC but I'm not 100% sure. From a different question it seems I should use one or the other, not both and as this use-case is for non-human users I've gone with IAM.

My nodejs program needs to do the following:

1. Start as the "Account B" IAM user "builder";
2. Create a public hosted zone for acme.example.com in "Account B" Route53
3. Retrieve the NS record from Route53 for the new hosted domain
4. Assume a role that allows it to create an NS record for the subdomain in the "Account A" Route 53
5. Create the NS record in the "Account A" Route 53
6. Revert to its original role
7. Create more stuff in "Account B"

Steps 1-3 are all working fine and I know how to do Steps 5 and 7+.
But Steps 4 and 6 have me stumped ... I've followed the logic from the IAM user guide above but I'm clearly missing something.

Grant permission to different account to update Route53

Relevant content