System Overview
Pattern summary
Section titled “Pattern summary”One Platform_Zone
Shared private hosted zone `platform.demo.local` in the Network_Account — the only place `api` and `db` records are defined. (platform.demo.local) lives in the Network_Account
AWS account that owns Platform_Zone, DNS records, and cross-account VPC_Association_Authorization resources.. Every other VPC associates with that zone so workloads resolve the same records regardless of account or region.
| API (concept) | Who calls it | Purpose |
|---|---|---|
CreateVPCAssociationAuthorization |
Network_Account (zone owner) | Permit a specific VPC (id + region) to associate |
AssociateVPCWithHostedZone |
VPC-owning account | Link the VPC to the authorized PHZ |
No Route 53 Profiles
Centralised Route 53 association lifecycle — alternative to classic authorization; not used in this walkthrough., AWS RAM
AWS Resource Access Manager — can share hosted zones; not part of this classic pattern., Transit Gateway, or orchestration scripts.
Accounts, regions, and stacks
Section titled “Accounts, regions, and stacks”Three AWS accounts, two regions, six Terraform stacks in the source demo repo:
| Stack | Account | Region | VPC role | CIDR |
|---|---|---|---|---|
network |
network | ap-southeast-2 | PHZ owner; primary + secondary | 10.0.0.0/16, 10.3.0.0/16 |
network-apse6 |
network | ap-southeast-6 | Same-account cross-region | 10.10.0.0/16 |
dev-apse2 |
dev | ap-southeast-2 | Cross-account workload | 10.1.0.0/16 |
dev-apse6 |
dev | ap-southeast-6 | Cross-account cross-region | 10.11.0.0/16 |
sandbox-apse2 |
sandbox | ap-southeast-2 | Cross-account workload | 10.2.0.0/16 |
sandbox-apse6 |
sandbox | ap-southeast-6 | Cross-account cross-region | 10.12.0.0/16 |
Each VPC gets one Test_EC2
One minimal EC2 per stack (seven total) for in-VPC DNS checks via SSM Session Manager and `dig`. in a private subnet (seven instances total) for in-VPC DNS verification via SSM.
Platform zone and records
Section titled “Platform zone and records”All shared DNS records exist only in the Network_Account PHZ
Private Hosted Zone — resolves DNS only from associated VPCs. This demo uses one authoritative PHZ in the network account.. Workload accounts resolve names; they do not create local copies.
| Record | Type | Value | Purpose |
|---|---|---|---|
api.platform.demo.local |
A | 10.0.1.10 | Primary demo lookup |
db.platform.demo.local |
A | 10.0.1.20 | Optional second record |
Record targets are fictional private IPs — they prove resolution, not reachability.
Topology
Section titled “Topology”Terraform module map (source demo)
Section titled “Terraform module map (source demo)”Phased dependency view
Section titled “Phased dependency view”See Deployment Phases for operational commands.