- Newest
- Most votes
- Most comments
Client traffic that comes from outside the VPC over a VPC peering connection, Transit Gateway, Direct Connect, or VPN can use the VPC service network endpoint to reach services and resource configurations. When you create a service-network VPC endpoint, AWS creates Regional DNS names (endpointId-snraId.rcfgId.randomHash.vpc-lattice-rsc.region.on.aws) for each resource and service that you can use to communicate with the resource and service from your VPC and from on-premises. These DNS records are public, therefore these DNS names are publicly resolvable. However, DNS requests from outside the VPC still return the private IP addresses of the service network endpoint's network interfaces. You can use these DNS names to access the resource and services from on-premises, as long as you have access to the VPC that the service network endpoint is in, through VPN or Direct Connect.
answered a year ago
Thank you for your questions regarding VPC endpoint type service network access from peering and on-premises environments. I'll address each of your questions separately.
Question 1: VPC peering does not automatically extend DNS resolution capabilities across peered VPCs. While you have successfully set up peering between Account-B and Account-C and added the necessary routes, DNS resolution for the service network endpoint doesn't automatically work across the peering connection. To enable DNS resolution from Account-C, you would need to set up additional DNS infrastructure.
One approach to resolve this issue is to use Amazon Route 53 Private Hosted Zones. You can create a private hosted zone in Account-B for the service network endpoint DNS, and then associate this hosted zone with the VPC in Account-C. This would allow EC2 instances in Account-C to resolve the service network endpoint DNS name.
Question 2: To resolve the VPC endpoint type service network DNS from on-premises over Direct Connect, you can use the following approach:
- Set up a Route 53 Resolver inbound endpoint in the VPC that has the Direct Connect connection.
- Configure your on-premises DNS server to forward DNS queries for the service network endpoint domain to the Route 53 Resolver inbound endpoint.
- Create a private hosted zone in the VPC with the Direct Connect connection, containing the DNS records for the service network endpoint.
You don't necessarily need to create a VPC endpoint type resource for this scenario. The existing service network endpoint in Account-B can be accessed from on-premises, provided you have the correct networking and DNS setup in place.
Remember that while the DNS names for service network endpoints are publicly resolvable, the actual network access is still private. Ensure that your network routing is correctly configured to allow traffic from on-premises to reach the VPC containing the service network endpoint.
These solutions will allow you to resolve and access the service network endpoint DNS from both the peered VPC in Account-C and from your on-premises environment over Direct Connect.
Sources
Access service networks through AWS PrivateLink - Amazon Virtual Private Cloud
Streamline DNS management for AWS PrivateLink deployment with Amazon Route 53 Profiles | Networking & Content Delivery
Centralized access to VPC private endpoints - Building a Scalable and Secure Multi-VPC AWS Network Infrastructure
answered a year ago
Relevant content
- AWS OFFICIALUpdated 4 years ago
i already did below but still not working. it resolve the DNS name with dig command but curl still not working. SG and NACLs are open.
One approach to resolve this issue is to use Amazon Route 53 Private Hosted Zones. You can create a private hosted zone in Account-B for the service network endpoint DNS, and then associate this hosted zone with the VPC in Account-C. This would allow EC2 instances in Account-C to resolve the service network endpoint DNS name