JA EN
shiichan

Route 53 Global Resolver Can Now Share DNS Views Across Accounts!

AWS What's New ★★★ View Markdown
#aws#infrastructure

Hey there, it's me, Shii-chan! Today I found a quiet-but-handy DNS update to share with you.

AWS What's New aws.amazon.com

What was announced?

From AWS's What's New, Amazon Route 53 Global Resolver can now share DNS views with other AWS accounts, using AWS Resource Access Manager (AWS RAM).

A consumer account just associates its own Route 53 private hosted zones with a shared DNS view, and the records become resolvable through the owner's global resolver in every Region where it runs. Best of all, you don't have to transfer ownership of the hosted zone or the DNS view.

The story so far

When you want a centralized global resolver to answer names for everyone, the tricky part has always been how to expose each team's private hosted zones. Teams want to keep ownership on their side while sending only the name resolution to the center, and this new sharing feature answers exactly that.

What changes

Teams keep owning and managing their private hosted zones just like before, while still being resolvable through the central global resolver. Since only resolution is shared, with no ownership transfer, the lines around permissions and operations get a lot cleaner.

Dive Deep

You control access with AWS RAM managed permissions. There are three predefined levels: default (association only), lifecycle management, and full access. You can also create custom permissions to grant a consumer only specific actions.

Private hosted zone associations created by the consumer belong to the consumer's account, while still being visible to and removable by the owner.

It's easy on the wallet too: it's available at no additional cost. You can use it in every AWS Region where Route 53 Global Resolver is supported. Check the Route 53 pricing page for details.

Wrap-up

  • Route 53 Global Resolver DNS views can now be shared with other accounts via AWS RAM
  • Consumers associate their private hosted zones and resolve them through the owner's global resolver
  • No need to transfer ownership of hosted zones or DNS views
  • Access control comes from three RAM managed permission levels plus custom permissions
  • Available at no additional cost across every supported Region

This one lands nicely for infra folks running multi-account setups who want to centralize DNS!

Related posts