Answers: <p>How about having all the subdomains pointing to the public endpoint of the load balancer? You can anytime use CNAME record for the pointing.</p>
  <p>You can easily modify your terraform code to fetch the endpoint of the load balancer and add/modify the DNS entry.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-07-28T06:47:07.950Z
Answers: 2022-07-28T06:47:07.950Z
Answers: Nitesh B.
Answers: <p>One simple way would be to delegate the subdomain of <code>mydomain.com</code> for each account to that account's Route53 service.  After you do this, the credentials that allow Terraform to create load balancers, servers, and other things in the Dev account can also create/update/delete the DNS records for <code>dev.mydomain.com</code>.  The different credentials that manage resources in the Stage account can also manage DNS entries in <code>stage.mydomain.com</code>.  The DNS for the different accounts is kept separate just like the other resources.</p>
  <p>The way to do this is to create <code>dev.mydomain.com</code> as a public domain in the Dev account's Route53.  Take down the list of DNS servers reported there, and add them as NS records for the name <code>dev.mydomain.com</code> in the Root account's Route53.  Follow a similar pattern for the subdomains for the other accounts.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-07-27T21:25:05.617Z
Answers: I did not know you can do that, that's pretty useful and I'm currently giving it a shot, will return and mark this as the answer/upvote later
Answers: SebastianG
Answers: CC BY-SA 4.0
Answers: 2022-07-28T19:37:21.140Z
Answers: I did hit a bit of a hurdle -- cant seem to figure out a way to request an SSL certificate for it due to aws_acm_certificate needing a 'fully qualified domain name'  -- any ideas of a workaround for this?
Answers: SebastianG
Answers: CC BY-SA 4.0
Answers: 2022-07-28T19:47:18.380Z
Answers: `dev.mydomain.com` would be a fully-qualified domain name (aka FQDN).  So would a name like `api.dev.mydomain.com`.  You would likely want to request the certificate from the Dev account's ACM rather than the ACM in the root account.
Answers: Sotto Voce
Answers: CC BY-SA 4.0
Answers: 2022-07-27T20:24:45.847Z
Answers: 2022-07-27T21:44:26.123Z
Answers: 2022-07-27T21:44:26.123Z
Answers: Sotto Voce
Body: <p>We currently have 4 aws accounts:</p>
  <ul>
  <li>root - consolidated billing, domain purchased via route 53</li>
  <li>development</li>
  <li>staging</li>
  <li>production</li>
  </ul>
  <p>And they're all managed via terraform cloud as separate workspaces.</p>
  <p>in dev/stage/prod I have a load balancer routing requests to ECS and various other resources.</p>
  <p>I'd like to use the same domain to point to each environment with the following path:</p>
  <ul>
  <li>dev.mydomain.com =&gt; development load balancer</li>
  <li>stage.mydomain.com =&gt; staging load balancer</li>
  <li>mydomain.com =&gt; prodution load balancer</li>
  </ul>
  <p>If they were all in 1 single AWS account/workspace, this would be easy peasy, take the output of that static IP and add it into the route 53 A record for each subdomain.</p>
  <p>But, is it possible at all to achieve this across multiple aws accounts, or is there a better pattern to follow to achieve this?</p>
  
Tags: <amazon-web-services><terraform><dns><terraform-workspace>
Title: dev/stage/prod in separate AWS accounts, managed via terraform cloud workspaces, how can I use lb ip in DNS records for each env?
UserDisplayName: SebastianG
ThreadText: # dev/stage/prod in separate AWS accounts, managed via terraform cloud workspaces, how can I use lb ip in DNS records for each env?
  
  (Asked by: username_0 on 2022-07-27)
  
  We currently have 4 aws accounts:
  
  * root - consolidated billing, domain purchased via route 53
  * development
  * staging
  * production
  
  And they're all managed via terraform cloud as separate workspaces.
  
  in dev/stage/prod I have a load balancer routing requests to ECS and various other resources.
  
  I'd like to use the same domain to point to each environment with the following path:
  
  * dev.mydomain.com => development load balancer
  * stage.mydomain.com => staging load balancer
  * mydomain.com => prodution load balancer
  
  If they were all in 1 single AWS account/workspace, this would be easy peasy, take the output of that static IP and add it into the route 53 A record for each subdomain.
  
  But, is it possible at all to achieve this across multiple aws accounts, or is there a better pattern to follow to achieve this?
  
  **Tags:** amazon-web-services, terraform, dns, terraform-workspace
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2022-07-27. Score: 1
  
  One simple way would be to delegate the subdomain of `mydomain.com` for each account to that account's Route53 service. After you do this, the credentials that allow Terraform to create load balancers, servers, and other things in the Dev account can also create/update/delete the DNS records for `dev.mydomain.com`. The different credentials that manage resources in the Stage account can also manage DNS entries in `stage.mydomain.com`. The DNS for the different accounts is kept separate just like the other resources.
  
  The way to do this is to create `dev.mydomain.com` as a public domain in the Dev account's Route53. Take down the list of DNS servers reported there, and add them as NS records for the name `dev.mydomain.com` in the Root account's Route53. Follow a similar pattern for the subdomains for the other accounts.
  
  > **Comments:**
  > **username_0**: I did not know you can do that, that's pretty useful and I'm currently giving it a shot, will return and mark this as the answer/upvote later  
  > **username_0**: I did hit a bit of a hurdle -- cant seem to figure out a way to request an SSL certificate for it due to aws_acm_certificate needing a 'fully qualified domain name'  -- any ideas of a workaround for this?  
  > **username_2**: `dev.mydomain.com` would be a fully-qualified domain name (aka FQDN).  So would a name like `api.dev.mydomain.com`.  You would likely want to request the certificate from the Dev account's ACM rather than the ACM in the root account.  
  
  ---
  
  ### Answer by username_1 on 2022-07-28. Score: 0
  
  How about having all the subdomains pointing to the public endpoint of the load balancer? You can anytime use CNAME record for the pointing.
  
  You can easily modify your terraform code to fetch the endpoint of the load balancer and add/modify the DNS entry.
  
  
  ---
  
  