# Delegate Subdomain between two AWS Accounts using Route 53

> Step-by-step guide on how to delegate Subdomain between two AWS Accounts using Route 53

Source: https://last9.io/docs/delegate-subdomain-between-aws-accounts-using-route-53/

:::note
This is specifically useful for Last9 BYOC deployments
:::

## Assumptions

1. AWS Account A is the Primary Account
2. AWS Account B is the Sub Account
3. `example.com` is an arbitrary domain used purely for easy understanding
4. You have enough permissions granted by your AWS Admin to add/modify Route53

## Premise

To set up `subdomain.example.com` as a hosted zone in **AWS Account B** and extend it for internal usage (e.g., `internal.subdomain.example.com`), you need to delegate authority for the subdomain from **AWS Account A** to **AWS Account B**.

This process involves creating a new hosted zone in **Account B** for the subdomain and then updating the parent hosted zone in **Account A** to delegate DNS resolution to the nameservers for the subdomain in **Account B**.

![AWS Route 53 Subdomain Delegation](../../../../assets/content/docs/tutorials/how-to-delegate-subdomain-between-two-aws-accounts-using-route-53/route53-subdomain-soa.png)

## Step-by-Step Procedure

### Step 1: Create a Hosted Zone for the Subdomain in Account B

1. **Sign in to the AWS Management Console for Account B**
2. **Create a Hosted Zone**:
   - Navigate to the Route 53 console
   - Click on **“Hosted zones”** in the left navigation pane
   - Click the **“Create hosted zone”** button
   - Enter `subdomain.example.com` as the domain name
   - Choose the type as “**Public hosted zone”** (or **Private hosted zone for Amazon VPC** if it's for internal usage)
   - Click **Create hosted zone**
3. **Note the Nameservers**:
   - After the hosted zone is created, note the nameservers (NS records) provided by Route 53 for the new hosted zone. You will need these nameservers to delegate the subdomain from Account A

### Step 2: Delegate the Subdomain from Account A to Account B

1. **Sign in to the AWS Management Console for Account A**
2. **Navigate to the Hosted Zone for `example.com`**:
   - Go to the Route 53 console
   - Click on **Hosted zones** in the left navigation pane
   - Click on the hosted zone for `example.com`
3. **Create NS Record for the Subdomain**:
   - Click **Create record**
   - Choose **Simple routing** and click **Next**
   - For **Record name**, enter `subdomain` (to delegate `subdomain.example.com`)
   - Choose **Record type** as **NS - Name Server**
   - In the **Value** field, enter the nameservers for `subdomain.example.com` provided by Account B
   - Click **Create records**

### Step 3: Create a Hosted Zone for Internal Usage in Account B

1. **Sign in to the AWS Management Console for Account B**
2. **Create a Hosted Zone for `internal.subdomain.example.com`**:
   - Navigate to the Route 53 console
   - Click on **Hosted zones** in the left navigation pane
   - Click the **Create hosted zone** button
   - Enter `internal.subdomain.example.com` as the domain name
   - Choose the type as **Private hosted zone for Amazon VPC**
   - Select the appropriate VPCs
   - Click **Create hosted zone**

## Verification

**Public Subdomain Delegation**:

- You can verify that `subdomain.example.com` is correctly delegated by using the `dig` or `nslookup` commands:

  ```
  dig ns subdomain.example.com
  ```

**Internal Subdomain Resolution**:

- For `internal.subdomain.example.com`, ensure that your VPC's DNS settings are configured correctly and that Route 53 resolver endpoints are set up if necessary

## Summary

1. **Create a hosted zone for `subdomain.example.com` in Account B** and note the nameservers
2. **Delegate the subdomain** from Account A to Account B by creating an NS record in the `example.com` hosted zone in Account A pointing to the nameservers for `subdomain.example.com` in Account B
3. **(Optional) Create a hosted zone for `internal.subdomain.example.com`** in Account B for internal DNS resolution

---

## Troubleshooting

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.