cross account role assume

[FernandoMiguel]

Describe the feature you are requesting
create ACM validation route53 records in another aws account route53

Motivation
EKS cluster with R53 zones in multiple accounts

Describe the proposed solution you'd like
Thank you so much for the new feature to be able to handle ACM issuing.
The LBC is only able to create ACM validation records in the same aws account R53 where the LB exists.
But we have R53 zones across multiple accounts.
We would need the LBC to be able to assume a list of roles in other accounts, roles that would have IAM privs to update that own account R53 zones.

Describe alternatives you've considered
we currently issue a small list of Certs with terraform and pass those ARNs to the LBC.
but this makes it very hard to create sub.sub.sub domain certs.

[the-technat]

Just to confirm: you are talking about Amazon issued certificates right? Not using PCA... (cause there no Route53 records are needed).

I've also realized that this is missing while adopting this feature this morning in our environment. I think it shouldn't be too difficult to pass in another IAM role to assume for Route53 route creation. But if I'm reading your description carefully it seems like you'd need multiple IAM roles depending on the DNS zone that needs to get updated?

That might become a bit more involved since then we'd need some sort of mapping to pass into the controller which DNS zone needs to get updated with what IAM role...

[FernandoMiguel]

@the-technat this is for public certs issued by ACM, not the PCA.
some other ACKs do support multi role, so LBC could borrow that pattern
AWS calls it CARM
https://github.com/aws-controllers-k8s/route53-controller/blob/f52bddffa26e4b86423b28933bdf852c83928ce4/helm/values.yaml#L177-L193

Docs: https://github.com/aws-controllers-k8s/community/blob/main/docs/design/proposals/carm/cross-account-resource-management.md

[shraddhabang]

Thanks for the feature request! I think this is valid request. I agree with @the-technat. The approach would be a domain-to-role mapping configuration where you specify which IAM role to assume for Route53 operations based on the domain. The controller would then assume the appropriate cross-account role when creating DNS validation records, similar to how we already handle cross-account target registration on TargetGroupBindings.

We'll track this as a follow-up enhancement to the ACM certificate management feature. Appreciate the CARM reference as well — useful pattern to draw from.