Streamlining Multi-Account AWS Organization DNS Management

Introduction

In this guide, we will streamline DNS management across multiple AWS accounts within an AWS Organization using Pulumi. We will use AWS Route 53 for DNS management and AWS Organizations for managing multiple accounts. The key services involved are AWS Route 53, AWS Organizations, and IAM roles for cross-account access.

Step-by-Step Explanation

Step 1: Set Up AWS Organizations

1. Create an AWS Organization if you don’t have one already.
2. Ensure that all your AWS accounts are part of the organization.

Step 2: Create IAM Roles for Cross-Account Access

1. Create an IAM role in each member account that allows Route 53 management.
2. Grant the necessary permissions to the IAM role.
3. Establish trust relationships between the member accounts and the management account.

Step 3: Set Up Route 53 in the Management Account

1. Create a Route 53 hosted zone in the management account.
2. Use Pulumi to automate the creation and management of the hosted zone.

Step 4: Delegate DNS Management to Member Accounts

1. Use Pulumi to create NS (Name Server) records in the management account’s hosted zone that delegate DNS management to the member accounts.
2. In each member account, create the necessary Route 53 records.

Step 5: Automate DNS Record Management

1. Use Pulumi to manage DNS records across all accounts.
2. Ensure that changes in DNS records are automatically propagated to all member accounts.

Conclusion

By following these steps, you can streamline DNS management across multiple AWS accounts within an AWS Organization using Pulumi. This approach centralizes DNS management, ensures consistency, and simplifies the process of managing DNS records across multiple accounts.

Full Code Example

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Step 1: Set Up AWS Organizations
const org = new aws.organizations.Organization("myOrg", {
    featureSet: "ALL",
});

// Step 2: Create IAM Roles for Cross-Account Access
const memberAccountRole = new aws.iam.Role("memberAccountRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
        AWS: "arn:aws:iam::managementAccountId:root",
    }),
    managedPolicyArns: [
        "arn:aws:iam::aws:policy/AmazonRoute53FullAccess",
    ],
});

const managementAccountRole = new aws.iam.Role("managementAccountRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
        AWS: "arn:aws:iam::memberAccountId:root",
    }),
    managedPolicyArns: [
        "arn:aws:iam::aws:policy/AmazonRoute53FullAccess",
    ],
});

// Step 3: Set Up Route 53 in the Management Account
const managementAccountHostedZone = new aws.route53.Zone("managementAccountHostedZone", {
    name: "example.com",
});

// Step 4: Delegate DNS Management to Member Accounts
const nsRecord = new aws.route53.Record("nsRecord", {
    zoneId: managementAccountHostedZone.id,
    name: "example.com",
    type: "NS",
    ttl: 300,
    records: [
        "ns-2048.awsdns-64.com.",
        "ns-2049.awsdns-65.net.",
        "ns-2050.awsdns-66.org.",
        "ns-2051.awsdns-67.co.uk.",
    ],
});

// Step 5: Automate DNS Record Management
const memberAccountHostedZone = new aws.route53.Zone("memberAccountHostedZone", {
    name: "sub.example.com",
});

const memberAccountARecord = new aws.route53.Record("memberAccountARecord", {
    zoneId: memberAccountHostedZone.id,
    name: "www.sub.example.com",
    type: "A",
    ttl: 300,
    records: ["192.0.2.44"],
});

export const managementAccountHostedZoneId = managementAccountHostedZone.id;
export const memberAccountRoleArns = [memberAccountRole.arn, managementAccountRole.arn];