By using AWS re:Post, you agree to the Terms of Use

Route53 record(s) to centralize VPC interface endpoints across multiple VPCs/regions

0

Hi, we tried to follow both articles:

[1] https://aws.amazon.com/blogs/networking-and-content-delivery/centralize-access-using-vpc-interface-endpoints/

[2] https://aws.amazon.com/blogs/architecture/using-vpc-endpoints-in-multi-region-architectures-with-route-53-resolver/

to create an organization-wide centralized access to some (S3, Api-Gateway, SSM) AWS services using VPC interface endpoints but it's not clear what record(s) I need to insert into Route53 PHZs. Adding only a domain root alias record (named like the zone) pointing to the VPC Endpoint as described in [1], doesn't work for me, applications trying to resolve resources names like:

  • m01olkffr5.execute-api.eu-central-1.amazonaws.com

  • mybucket.s3.eu.-central-1.amazonaws.com

fail with "unknown host".

Should I use a wildcard (*) record?

Thanks in advance

3 Answers
1
Accepted Answer

Yes, for s3 and to support all bucket.s3... URL, you will need a wildcard record in the PHZ. This ( https://aws.amazon.com/blogs/networking-and-content-delivery/secure-hybrid-access-to-amazon-s3-using-aws-privatelink/) provides great detail on different options to work with S3 endpoints, with PHZ instruction under 'option 3'.

For API Gateway, when you associate endpoint with the REST API, API gateway will create the alias record for you (for <api>-<vpce id>.execute-api.... ). You may not want to create wildcard record for *.execute-api.., if not all your API calls go through the same VPC endpoint.

answered 8 months ago
1

Hello, When centralizing access to VPC Interface Endpoints powered by PrivateLink, you should create a record that covers all possible queries that you would want to forward to that endpoint. So taking for example, Amazon S3: if you only want to forward queries for examplebucket to that endpoint then you would only create a record for examplebucket.s3.<region>.amazonaws.com and have it point to that VPC endpoint. If you want to forward all S3 queries to that endpoint, then you can create *.s3.<region>.amazonaws.com.

EXPERT
answered 8 months ago
EXPERT
reviewed 8 months ago
1

Hi! The first blog you list (Centralize access using VPC interface endpoints to access AWS services across multiple VPCs) explains very good the steps to follow to configure PHZs and ALIAS records. So, in the example of an S3 VPC endpoint, you first create the PHZ s3.eu-central-1.amazonaws.com, and later the ALIAS record mybucket.s3.eu-central-1.amazonaws.com pointing to the VPC endpoint (as it is explained in Step 2). That configuration should work.

Have you associated the PHZ to all the VPCs that need the DNS resolution? You can try to use the wildcard option to check if the rest of the configuration is done properly. If with the wildcard does not work, maybe you need to check again that you followed all the other steps correctly.

answered 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions