Share domain and SSL certificate within member accounts in an organization

Question

I am not finding much information on how to share some resources within an organization. 
The Resource Access Management does not seem to have domains, hosted zones or SSL certificates amongst its resources. So my question is: Is it possible to share domain and SSL certificate within accounts in an organization?

Suppose I have an account 019735371715 which is the managing account of an organization.
In this account I've purchased Route 53 domain: *foo.io*
In this account I also have a hosted zone associated to *foo.io* and a SSL certificate (in certificate Manager) associated to *foo.io* and **.foo.io*

I have created some member accounts within the organization from my managing account:
***804 and ***753

I want to treat this accounts as "environments" for my product
so I want ***804 to have resources accessible through an Api Gateway and subdomain *test.foo.io*
and I want ***753 to have resources accessible through an Api Gateway and no subdomain, so *foo.io*

That means that when creating resources in those member accounts I need to use the domain purchased by the managing account and, possibly the hosted zone and the SSL certificate.

Is this possible? How would I do that? Can I do that and have each member account have its own Api Gateway and DNS records?

Answer

You can not share domains or certificates across Accounts nor certificates across regions either.
This is more of an architecture design.

2 Ways to deal with this.

**Option 1**
1. What you need to do is create the ACM certificate in the member accounts.
2. Then create the CNAME records in the Account which has the hosted zone so that ACM can validate and issue the certs in the member acconuts.
3. The cert is issued in the member account and you can tie your resources to the cert.
4. If you need any records creating you create them in the account which hosts the route53 zone..

**Option 2**
1. Use sub domains for each account...
2. Your Top domain would be example.com
3. You create a subdomain in member account 1 called, sub-domain1.example.com
4. Create NS records in the example.com zone for sub-domain1.example.com
5. You request all your certs in this member account and create the dns records in this account in the sub domain zone.

Either way yes you can have each member account to have its own resources such as an ALB and API Gateway etc

Note: You can grant access to resolve private zones between VPC's

Share domain and SSL certificate within member accounts in an organization

Relevant content