Associate private hosted zone to another account, (NotAuthorizedException) (exit status 255) - share

Question

I am using terraform to script the sharing of private hosted zone to another AWS account.
Step 1: (In account A) Create 3 private hosted zone with Account A's VPC attached
Step 2: (In account A) Create authorization to Account B' VPC, Account C' VPC
Step 3: (In account B, account C, using assume role) Associate VPC to Account A's private hosted zone
however, in step 3, following errors occur:
2 error(s) occurred:
* module.assciation_mtc.null_resource.associate_with_remote_zone[1]: Error running command 'aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z13ZRIFNAA9HJT --vpc VPCRegion=ap-southeast-1,VPCId=vpc-05dc595cd7378171d': exit status 255. Output:
An error occurred (NotAuthorizedException) when calling the AssociateVPCWithHostedZone operation: The VPC: vpc-05dc595cd7378171d has not authorized to associate with your hosted zone.
* module.assciation_mtc.null_resource.associate_with_remote_zone[0]: Error running command 'aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z2N32DMQZFGH6V --vpc VPCRegion=ap-southeast-1,VPCId=vpc-05dc595cd7378171d': exit status 255. Output:
An error occurred (NotAuthorizedException) when calling the AssociateVPCWithHostedZone operation: The VPC: vpc-05dc595cd7378171d has not authorized to associate with your hosted zone.
I have tried to use the exact command using AWS CLI, it works. But don't know why the script fails when terraform excuting it.
Tried Command in Account B, Account C:
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z2N32DMQZFGH6V --vpc VPCRegion=ap-southeast-1,VPCId=vpc-05dc595cd7378171d
Terraform Folder Hierarchy:
route53
create_zone
authorization_create
association
/route53/main.tf
//authorize each zone with all vpc
module "authorize_zone_ss" {
source = "./authorization_create"
providers {
aws = "aws.provider_ss"
}
zone_id = "${module.creat_zone.zone_ids[0]}"
zone_ids = ["${module.creat_zone.zone_ids}"]
vpc_ids = ["${var.vpc_ids}"]
}
//associate each vpc to all zone
module "assciation_mtc" {
source = "./association"
providers {
aws = "aws.provider_mtc"
}
zone_ids = ["${module.creat_zone.zone_ids}"]
vpc_id = "${var.vpc_ids[2]}"
}
/route53/authorization_create/main.tf
data "aws_region" "current" {}
//associate 1 private zone with all account's vpc
resource "null_resource" "create_remote_zone_auth" {
count = "${var.zone_number -1}"
triggers {
vpc_id = "${element(var.vpc_ids, count.index +1)}"
}
provisioner "local-exec" {
command = "aws route53 create-vpc-association-authorization --hosted-zone-id ${var.zone_id} --vpc VPCRegion=${data.aws_region.current.name},VPCId=${element(var.vpc_ids, count.index +1)}"
}
}
/route53/association/main.tf
data "aws_region" "current" {}
//associate this vpc to all route 53 private zone
resource "null_resource" "associate_with_remote_zone" {
count = "${var.vpc_number -1}"
triggers {
zone_id = "${element(var.zone_ids, count.index +1)}"
}
provisioner "local-exec" {
command = "aws route53 associate-vpc-with-hosted-zone --hosted-zone-id ${element(var.zone_ids,count.index)} --vpc VPCRegion=${data.aws_region.current.name},VPCId=${var.vpc_id}"
}
}
Expected Results:
All account's VPC (account A,B,C) are authorized to share with all the zone.
ie.
Account A zone 1: Associated with Account A/B/C's VPC
Account A zone 2: Associated with Account A/B/C's VPC
Account A zone 3: Associated with Account A/B/C's VPC
Actual Results:
Error happened when executing the command: associate-vpc-with-hosted-zone
Reference :
https://medium.com/#dalethestirling/managing-route53-cross-account-zone-associations-with-terraform-e1e45de8f3ea

Answer 1

You have to assume the role you want to use before running the local-exec command:
aws sts assume-role --role-arn 'arn-of-role' --role-session-name 'role_session_name' --duration-seconds 3600 --output json
Then export the values so they are used by TF as part of environment variables:
export AWS_ACCESS_KEY_ID=$(echo "${aws_creds}" | grep AccessKeyId | awk -F'"' '{print $4}' )
export AWS_SECRET_ACCESS_KEY=$(echo "${aws_creds}" | grep SecretAccessKey | awk -F'"' '{print $4}' )
export AWS_SESSION_TOKEN=$(echo "${aws_creds}" | grep SessionToken | awk -F'"' '{print $4}' )
export AWS_SECURITY_TOKEN=$(echo "${aws_creds}" | grep SessionToken | awk -F'"' '{print $4}' )
Run the above using the relevent details for your environment and then run the auth / association afterwards

Answer 2

I have find out the problems.
Terraform doesn't take up the role in the null_resources block, so the command is executing using the original terraform role.
I am still trying the solutions.
Is there any help?

Answer 3

Terraform has supported route53_vpc_association_authorization to authorize a VPC in a peer account to be associated with a local Route53 Hosted Zone.
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization
The solution now can be implemented through TF natively, no need to use null_resource which is covered by CLI