Is it possible to share Private zones over multiple VPCs?

[josephDunne]

I tried to add the same private zone to multiple vpc configs but I get the errors:

Error: There is already a Construct with name 'myprivatezone-com_pz' in AccountStack [SharedNetworkPhase3]
--
37 | at Node.addChild (/app/node_modules/.pnpm/constructs@3.3.71/node_modules/constructs/src/construct.ts:534:13)
38 | at new Node (/app/node_modules/.pnpm/constructs@3.3.71/node_modules/constructs/src/construct.ts:75:22)
39 | at new ConstructNode (/app/node_modules/.pnpm/@aws-cdk+core@1.144.0/node_modules/@aws-cdk/core/lib/construct-compat.ts:184:24)
40 | at Object.createNode (/app/node_modules/.pnpm/@aws-cdk+core@1.144.0/node_modules/@aws-cdk/core/lib/construct-compat.ts:55:11)
41 | at new Construct (/app/node_modules/.pnpm/constructs@3.3.71/node_modules/constructs/src/construct.ts:575:26)
42 | at new Construct (/app/node_modules/.pnpm/@aws-cdk+core@1.144.0/node_modules/@aws-cdk/core/lib/construct-compat.ts:52:5)
43 | at new CfnElement (/app/node_modules/.pnpm/@aws-cdk+core@1.144.0/node_modules/@aws-cdk/core/lib/cfn-element.ts:31:5)
44 | at new CfnRefElement (/app/node_modules/.pnpm/@aws-cdk+core@1.144.0/node_modules/@aws-cdk/core/lib/cfn-element.ts:106:1)
45 | at new CfnResource (/app/node_modules/.pnpm/@aws-cdk+core@1.144.0/node_modules/@aws-cdk/core/lib/cfn-resource.ts:68:5)
46 | at new CfnHostedZone (/app/node_modules/.pnpm/@aws-cdk+aws-route53@1.144.0/node_modules/@aws-cdk/aws-route53/lib/route53.generated.ts:622:9)

I added the same private zone to the vpc config of two organisation units:

...
         "zones": {
            "private": ["myprivatezone.com"],
            "public": []
          }
....
          "zones": {
            "private": ["myprivatezone.com"],
            "public": []
          }

and I had hoped that would create one private zone shared with two VPCs. Is there a different way to achieve the same thing? i.e. share dns between the central vpc and a workload vpc?

Thank you for project!

[Brian969]

• create the private zones on the VPC with "central-endpoint": true set (i.e. the Endpoint VPC)
• on the ou/workload account VPC, set "use-central-endpoints": true
• the zone will be attached to the OU/workload account VPC