Cross-account Route 53 access using IAM Identity Center permissions

Question

I'm trying to make changes to a Route 53 hosted zone in one account (Account A), from a different AWS account (yep – Account B). The two accounts are enrolled in the same Organisation. We use IAM Identity Center to sign in (so not vanilla IAM).

I have edited the permission set for the Identity Center user, with an inline policy to allow access to the Route 53 hosted zone:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:GetHostedZone",
                "route53:ChangeResourceRecordSets",
                "route53:ListResourceRecordSets"
            ],
            "Resource": [
                "arn:aws:route53:::hostedzone/"
            ]
        }
    ]
}
```

However, I keep getting permission denied errors:

```sh
% aws route53 get-hosted-zone --profile staging --id

An error occurred (AccessDenied) when calling the GetHostedZone operation: User: arn:aws:sts:::assumed-role/AWSReservedSSO_AdministratorAccess_/ is not authorized to access this resource
```

I've checked the user is correct with `aws sts get-caller-identity --profile staging`.

The same request from my Identity Center user signed in to Account A (`aws route53 get-hosted-zone --profile develop --id `) works as it normally would, with a description of the zone.

As a sanity-check I also made a role in Account A to allow a trust relationship with the Identity Center user, and group, and account root, but still get the same error.

… which makes me wonder if there are some Route 53 wrinkles that make x-account access a bit trickier. AWS [seems to think](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources) it should be doable though!

Will appreciate any guidance, thank you.

Answer

I don't see in the documentation where it says that you can do what you're trying to do.

To clarify:
* You have a Route 53 zone created in account A.
* You want a user in account B to manage the zone in account A.

The [way to do this](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html) is:
* Create a role in account A that has the required permissions.
* Give permission to the role in account B to assume the role in account A.
* When authenticated as the role in account B (which it appears you are); assume the role in account A.
* Use the new credentials to perform the Route 53 actions in account A.

The documentation you've linked to does mention this in the section that starts with `Attach a permissions policy to a role (grant cross-account permissions)`.

Cross-account Route 53 access using IAM Identity Center permissions

Relevant content