Very ambiguous statement in documentation

[markl11]

"The TENANT_DOMAIN must be an AWS registered domain and hosted zone on Route53 in the same AWS IAM role (e.g. arn:aws:iam::555555555555:role/ROLE) as your EKS cluster. For example, if it is set to k8s-icecream.ping-devops.com, then ping-devops.com must be a valid DNS domain registered by some registrar (e.g. AWS Route53). There must also be a hosted zone created for it on AWS Route53."

This statement is a little meaningless - a hosted zone is not 'in an AWS IAM role', so this what exactly do you mean here? Thanks.