This message was deleted.

I delegate subdomains to other accounts from a top level account. My first rule of thumb is to never have things like registered domain in templates that I plan on running much. I'll refer to said domains with remote state lookups or data queries in projects that I iterate on. For this I'd create a template for your parent account and a template for the child accounts. I'd create workspaces on the child template to satisfy all the accounts that need to be setup (this is mainly to handle provider silliness in a DRY fashion). In the parent account, I'd setup a registration for the main domain, then delegate authority for subdomains (like *.dev.example.com) to specific name servers. In the child accounts I'd create a route53 hosted zone with the domain that was delegated to it and ensure that the nameservers I use are the ones defined in the parent account. From there, I'd do a data query or remote state lookup in any terraform project that used that domain, so it can inherit it without accidently modifying it.

Thanks for the input, I normally also prefer external DNS on a k8s cluster What about customer facing frontend domains, eg a production domain without the environment as subdomain, do you just configure it in the prod account that is going to use it, or setup even that domain in a parent account and delegate the domain to the child account (only reason I could think of doing something like this would so you have one place where you can check all your domains, if this customer facing domain is setup directly in a child prod account, you quickly lose overview of what domains that are in use, though not sure if that is an actual problem though)

Yeah, I think that's just an aesthetics choice and what you'd think makes the most sense. I wouldn't fault you for using the prod account as the parent in this case. Hell, you could do the entire thing in one big template if you want (but because a provider for each account is a thing it would mean your code would end up being really not dry).

thanks, then I have an idea on how to continue with the setup 👌