0

We currently have 4 aws accounts:

  • root - consolidated billing, domain purchased via route 53
  • development
  • staging
  • production

And they're all managed via terraform cloud as separate workspaces.

in dev/stage/prod I have a load balancer routing requests to ECS and various other resources.

I'd like to use the same domain to point to each environment with the following path:

  • dev.mydomain.com => development load balancer
  • stage.mydomain.com => staging load balancer
  • mydomain.com => prodution load balancer

If they were all in 1 single AWS account/workspace, this would be easy peasy, take the output of that static IP and add it into the route 53 A record for each subdomain.

But, is it possible at all to achieve this across multiple aws accounts, or is there a better pattern to follow to achieve this?

Improve this question

2 Answers 2

Reset to default
1

One simple way would be to delegate the subdomain of mydomain.com for each account to that account's Route53 service. After you do this, the credentials that allow Terraform to create load balancers, servers, and other things in the Dev account can also create/update/delete the DNS records for dev.mydomain.com. The different credentials that manage resources in the Stage account can also manage DNS entries in stage.mydomain.com. The DNS for the different accounts is kept separate just like the other resources.

The way to do this is to create dev.mydomain.com as a public domain in the Dev account's Route53. Take down the list of DNS servers reported there, and add them as NS records for the name dev.mydomain.com in the Root account's Route53. Follow a similar pattern for the subdomains for the other accounts.

Improve this answer
3
  • I did not know you can do that, that's pretty useful and I'm currently giving it a shot, will return and mark this as the answer/upvote later
    – SebastianG
    Commented Jul 27, 2022 at 21:25
  • I did hit a bit of a hurdle -- cant seem to figure out a way to request an SSL certificate for it due to aws_acm_certificate needing a 'fully qualified domain name' -- any ideas of a workaround for this?
    – SebastianG
    Commented Jul 28, 2022 at 19:37
  • dev.mydomain.com would be a fully-qualified domain name (aka FQDN). So would a name like api.dev.mydomain.com. You would likely want to request the certificate from the Dev account's ACM rather than the ACM in the root account.
    – Sotto Voce
    Commented Jul 28, 2022 at 19:47
0

How about having all the subdomains pointing to the public endpoint of the load balancer? You can anytime use CNAME record for the pointing.

You can easily modify your terraform code to fetch the endpoint of the load balancer and add/modify the DNS entry.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.