Multiple AWS accounts

Yes, that's a much clearer question. I don't know if certbot's aws-route53 plugin supports multiple aws credentials. (Honestly, I could never get certbot's route53 plugin working on the same system I had aws-cli installed since they needed like different python versions or something like that, but it's not like I'd tried very hard to make it work.) It may be easier using some other ACME client that's designed for more complicated integrations than the "just install and go" that certbot tries to be, though you can probably make certbot work if you can write your own manual authorization script that uses the right credentials for the right domain. I've looked at a couple popular ACME clients and don't see one that obviously supports multiple AWS accounts, but I would have thought that it would be a normal thing. So maybe this is slightly harder than I initially thought.

Another option might be to delegate one account's domain's _acme-challenge name with a CNAME or NS to the other account's domain zone, and then you would only need one set of credentials, assuming that whomever needs these domains to be in different AWS accounts would be okay with that. Or even delegate it out of AWS entirely, to something like acme-dns or agnos. Not sure if that would make things simpler or more complicated for you. Like all of engineering, there's no perfect solution, there is just trying to understand what tradeoffs you're making.

And maybe someone else here has another suggestion for you.

5 Likes