AWS Organizations - Different accounts for different environments

[afgallo]

Firstly, kudos to the team for pushing out v1.8.0 which I was particularly interested due to the addition of custom DNS 🎉

I have a question, though. I understand that Copilot supports different AWS accounts for keeping environments like dev, prod isolated. This is great! How should I go about using http.alias in a multi-account scenario? I imagine there will be a single hosted zone which is currently managed in Route 53 (in some sort of root or main account) and all my environments share it?

Any help will be greatly appreciated.

[iamhopaul123]

Hello @afgallo! The default domain is formatted as svc.env.app.domain under the hood Copilot creates an app hosted zone (app.domain) and env hosted zone per environment (env.app.domain). So both app hosted zone and the root hosted zone (created by route53 when you purchase the domain) are shared across the whole app. You could either place the alias in the app hosted zone (e.g., v1.app.domain) or root hosted zone (e.g., v1.domain) for multi-account scenario.

[afgallo]

Okay, so it sounds like Copilot can figure itself out. I am still a little confused though. Imagine I have a shared services account where I host my domain name and then a dev and prod accounts. If I'm using Copilot to stand up a new app and env in dev, how does it know it needs to look at route53 in my shared-services account? Does that make sense?

[iamhopaul123]

Ok so if I understand correctly, you have an app account with your domain and prod and dev account for two environments. In this scenario there'll be 4 hosted zone: root hosted zone and app hosted zone are in your app account while for each two environment they'll have their own env hosted zone. We would follow the responsibility delegation rule to place your A record in the corresponding subdomain hosted zone. For example, we won't place v1.app.domain in root hosted zone but instead it will be placed in the app hosted zone. Does it make sense to you?

[afgallo]

Great, it does! Thanks for your help!

[tyoc213]

@iamhopaul123 if still there, the link provided links to "Checking the status of your changes (API only)" is that expected? or is there any new link to point to?

[iamhopaul123]

Hello @tyoc213. Sorry just fixed the link.

[afgallo]

Hi @iamhopaul123 I have finally got around to start deploying my application using copilot and have come across this issue #2554, just though I'd flag this here so other may also benefit.

Thanks!

[iamhopaul123]

Thank you for reporting the issue! Replied in that thread.