Hi, everyone, and welcome back.
Now in today's video, we are going to discuss about the Cross Account Association of a private hosted
zone in Route 53.
Now, whenever you create a private hosted zone in Route 53, you will get the option to associate it
with the VPC that are part of the same account.
For example, if you look into this screenshot, I'm trying to create a private hosted zone called Labs
DOT Internal.
So you see it's a private hosted zone and then it will ask you for a region and the VPC ID to which
this zone will be associated and the resources that are part of the VPC will be able to resolve the
domains that you add as part of this private hosted zone.
For example, whenever you create a hosted zone, let's select the private hosted zone.
You see that it asks you for the region.
Let's for an example, I'll select the region of Southeast one and then you'll have to supply the VPC.
So since I only have one default VPC over here, this is the VPC that I can add and the EC two instances
and the resources that are part of this VPC will be able to resolve all the records that I have as part
of the zone.
Now, one of the challenges that you will see over here in most of the organizations, you have multi
account based architectures.
So there are so many accounts that are present and it can happen that this specific private hosted zone
is in a central account and you want all of the records to be resolvable in the application VPC that
are running in a different account all together.
So in order to overcome this, Route 53 also supports the functionality of associating a private hosted
zone to a VPC that belongs to other account.
So you have a private hosted zone in account A and you're associating it with A VPC in account B, So
even the resources in account B that are part of the VPC will be able to resolve the records as part
of this zone.
So let's do one thing.
Let's go ahead and quickly have a demo to understand this practically.
Now for today's demo I have a hosted zone college dot internal, so if I'll open up this hosted zone,
there is one specific record of 01. KPBS dot internal and the value here is 192 168 2.10.
Now, if you look into this hosted zone details, it is associated with two VPC.
This one is in the US East, one second one in the AP, South one.
So within the EC2 instance associated with the VPC in US East one, let's quickly connect here.
And let's verify if this zero one CFPB's internal record is resolvable.
So let's do one thing.
I'll quickly do a NSS lookup on 01. CP Labs or Internal.
And as expected, it is resolvable.
So this is associated with this VPC ending with f5a.
Let's also verify.
Let's go back to the instance.
If you look into the VPC here it is f5e.
Now the second VPC that this zone is associated with is in the AP South one, which is the Mumbai region
and the VPC ID ends with a65.
So let's also try it out.
So I'll quickly go to the VPC console.
Will switch to the Mumbai region.
So you have the AP south one region.
If we look into the available VPC, you'll see we only have one default VPC and it ends with three for
three, which is not matching this specific one.
So at the overview, this specific VPC that we see over here is not part of this account, but it is
part of another account.
Now from a different browser, I am logged into a sandbox account.
If we go to the VPC over here we have one VPC that ends with a 65 and it matches the associated VPC.
So let's do one thing.
Let's quickly go to the EC two console.
We also have one easy to instance that is running here.
Let's connect to this EC two instance and verify if the records are resolvable.
So within here I'll also do an NSS lookup 01. CP Labs dot internal and you'll see as expected the records
are resolving perfectly well.
All right.
I hope with this you understood at a high level overview about the architecture where private hosted
zone can be associated with a VPC in a different account also.
Now, one thing that I wanted to show you is that at this stage from the GI, you will not be able to
associate a private hosted zone with another accounts VPC.
So for this you will have to go through the CLI or the API based way.
However, for this video, the CLI based steps are out of scope.
The main aim was to understand that this type of architecture is possible.
So with this will conclude today's video.