Access VPC resource over Lattice?
Inspired from these 2 announcements
- https://aws.amazon.com/about-aws/whats-new/2024/12/access-vpc-resources-aws-privatelink/
- https://aws.amazon.com/about-aws/whats-new/2024/12/vpc-lattice-tcp-vpc-resources/
and after watching https://www.youtube.com/watch?v=SRgwjU18nvk I wanted to test myself how to access resource (in my test case RDS) in another VPC using PrivateLink and Lattice. So I created 2 VPCs (Resource & Client) in same account and region (trying to keep things simple) ...
Resource VPC has an RDS instance and Resource Gateway. Then I added Resource Configuration using ARN of RDS instance to Resource Gateway. Next I created Resource Endpoint for RDS Resource Configuration and attached it to Client VPC.
I could connect from EC2 in Client VPC to RDS database in Resource VPC using the original RDS DNS name. Connection goes via Resource Endpoint in Client VPC and DNS is automagically mapped to IP in Client VPC. Everything works fine when using PrivateLink !!!
Then I removed Resource Endpoint from Client VPC, Created a Lattice Service network and associated RDS Resource Configuration to Service network, and finally created association with Client VPC. This added 3 routes into Client VPC route table pointing to VpcLattice as it should, so association worked. (Destinations 129.224.0.0/17, 169.254.171.0/24 and fd00:ec2:80::/64 are routed to VpcLattice)
But where do I find the DNS or IP I should use when connecting from Client VPC to RDS over Lattice network? Original RDS DNS from Client VPC resolves now to addess in Resource VPC, not to one of CIDRs that were added to Client VPC route table.
- Language
- English
- Newest
- Most votes
- Most comments
When accessing VPC resources over Amazon VPC Lattice, the process is slightly different from using AWS PrivateLink directly. In your scenario with VPC Lattice, you need to use a different DNS name to connect to your RDS instance.
When you associate a resource configuration with a VPC Lattice service network, VPC Lattice generates a new DNS name for accessing the resource. This DNS name is different from the original RDS endpoint.
To find the correct DNS name to use:
- Go to the VPC Lattice console and select your service network.
- Look for the resource configuration associated with your RDS instance.
- You should see a new DNS name generated by VPC Lattice for this resource.
This new DNS name will resolve to the appropriate IP addresses within the CIDRs that were added to your Client VPC route table (129.224.0.0/17, 169.254.171.0/24, and fd00:ec2:80::/64).
When connecting from your EC2 instance in the Client VPC to the RDS database, use this new VPC Lattice-generated DNS name instead of the original RDS endpoint. This ensures that your connection goes through the VPC Lattice service network.
Remember that when using VPC Lattice, you're not directly connecting to the original RDS endpoint. Instead, you're accessing it through the VPC Lattice service network, which provides the necessary routing and connectivity.
If you're having trouble finding the new DNS name or if it's not working as expected, double-check your VPC Lattice configuration, ensuring that the resource configuration is correctly associated with the service network and that the Client VPC association is properly set up.
Sources
VPC resources in VPC Lattice - Amazon VPC Lattice
Resource configurations for VPC resources - Amazon VPC Lattice
Access VPC resources through AWS PrivateLink - Amazon Virtual Private Cloud
When you create a resource for RDS using ARN, you get parent and child resource. My mistake was to look for DNS entry in parent resource. Lattice DNS name is found from child resource association details.
Relevant content
- AWS OFFICIALUpdated 4 years ago
Will this support secure connection ?