DNS
VPC DNS resolver, Route 53 public/private zones, TTL strategy, and ECS Cloud Map service discovery.
- This builds on The VPC Itself through Security Groups vs NACLs. Your VPC, subnets, route tables, IGW, SGs, and NACL must exist.
- In a new terminal session, run the resume script at the end of Security Groups vs NACLs.
- Read the callout before every step. Predict what will happen, then run it.
VPC DNS Resolver
Goal
Understand the built-in DNS resolver every VPC has. Confirm its address. Test resolution from inside the VPC. Understand what breaks when you turn it off.
Estimated time: 30 minutes
Understand the resolver address
What's happening here
Every VPC has a built-in DNS resolver available at a fixed address: VPC base CIDR + 2. For our lab VPC (10.0.0.0/16), the resolver is at 10.0.0.2. This resolver is also reachable at the link-local address 169.254.169.253 from any instance regardless of VPC CIDR. It handles all DNS queries from resources inside the VPC: public hostnames (resolving to real internet IPs), AWS service endpoints (like sqs.us-east-1.amazonaws.com), and private hosted zone records (covered later in this lab).
Two VPC attributes control DNS behaviour:
enableDnsSupport: enables the VPC resolver. If off, there is no DNS inside the VPC. Resources can't resolve anything.enableDnsHostnames: gives EC2 instances public DNS hostnames (e.g.ec2-54-1-2-3.compute-1.amazonaws.com). RequiresenableDnsSupportto be true.
Both must be true for most workloads. They were set in The VPC Itself.