1 Answer
- Newest
- Most votes
- Most comments
1
Your subnet design is independent of AWS VPC DNS, see below statement:
The Amazon DNS server does not reside within a specific subnet or Availability Zone in a VPC. It's located at the address 169.254.169.253 (and the reserved IP address at the base of the VPC IPv4 network range, plus two) and fd00:ec2::253. For example, the Amazon DNS Server on a 10.0.0.0/16 network is located at 10.0.0.2. For VPCs with multiple IPv4 CIDR blocks, the DNS server IP address is located in the primary CIDR block.
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html
Relevant content
- asked 6 years ago
- asked 6 years ago
- AWS OFFICIALUpdated 9 months ago
- AWS OFFICIALUpdated 9 months ago
- AWS OFFICIALUpdated 7 months ago
Just mentioning for clarity that this does mean that the subnet containing VPC Primary CIDR base+2 is special, and this should be taken into account with network design.
For example, with the topology shown at https://aws-quickstart.github.io/quickstart-aws-vpc/ the VPC is 10.0.0.0/16, so the DNS server will use the IP 10.0.0.2, which is located within "Availability Zone 1" / "Private subnet A". If there were ACLs that prevented any of the other subnets from communicating with that subnet then systems on those subnets could only use the 169.254.169.253 IP for the AWS DNS service.