Task Statement 2.2: Implement routing and connectivity across multiple AWS accounts, Regions, and VPCs to support different connectivity patterns.

📘AWS Certified Advanced Networking – Specialty

Host and Service Name Resolution for Applications and Clients in AWS

When you connect multiple AWS accounts, VPCs, and Regions, applications and clients need a way to find each other. They don’t use IP addresses directly all the time. Instead, they use names, like webserver.example.com or db.internal.aws. This process of translating names into IP addresses is called name resolution, and it’s mostly handled by DNS (Domain Name System).

AWS provides several services and methods to manage name resolution across complex environments.

1. DNS Basics in AWS

DNS converts human-readable names into IP addresses so applications and services can communicate.

Example in IT terms: When an application tries to access a database in another VPC, it uses a DNS name like db.internal.aws. DNS translates this into an IP like 10.0.5.20.
Without DNS, applications would need to hard-code IP addresses, which is hard to manage, especially in dynamic cloud environments where IPs can change.

Key Points for Exam:

Applications in one VPC or account often need to resolve names of services in other VPCs or accounts.
AWS provides private hosted zones in Route 53 for internal DNS resolution.

2. DNS Options in Multi-VPC and Multi-Account AWS Setups

A. Amazon Route 53 Private Hosted Zones

Used to create DNS zones only accessible within a VPC.
Lets applications resolve names like app.internal.company.com.
Can be shared across multiple VPCs using AWS Resource Access Manager (RAM).

Exam tip:
Remember, Private Hosted Zones do NOT automatically work across accounts or Regions. You must associate the hosted zone with each VPC where resolution is required.

B. VPC-Provided DNS

Every VPC in AWS has a built-in DNS resolver at +2 in the VPC CIDR block.
- Example: If your VPC CIDR is 10.0.0.0/16, the DNS resolver is 10.0.0.2.
Resolves:
- AWS services endpoints (like S3 or DynamoDB)
- EC2 hostnames within the same VPC
Configurable via the VPC attributes:
- enableDnsSupport – allows the VPC to use DNS
- enableDnsHostnames – allows EC2 instances to have DNS names

C. Cross-VPC DNS Resolution

When you have multiple VPCs, DNS resolution between them depends on your connectivity:

Connectivity Pattern	DNS Method
VPC Peering	Enable DNS resolution over peering. Use private hosted zones or VPC DNS.
Transit Gateway	Use Route 53 Resolver rules to forward DNS queries between VPCs.
Different AWS Accounts	Share private hosted zones via RAM and configure VPC associations.

Exam tip:

For peered VPCs in the same or different accounts: enable “Allow DNS resolution from peer VPC”.
For Transit Gateway or multi-account setups: use Route 53 Resolver inbound/outbound endpoints.

3. Route 53 Resolver Endpoints

If you want to resolve names across VPCs, accounts, or on-premises networks, AWS offers Route 53 Resolver Endpoints:

Inbound Endpoint: Allows DNS queries from outside the VPC (like from on-premises or another account).
Outbound Endpoint: Sends DNS queries from the VPC to external networks (like private hosted zones in another account or on-prem DNS servers).

Key features:

Supports forwarding rules, so queries for specific domains can be sent to the right location.
Works for hybrid environments where on-prem services must be accessed by AWS workloads.

Example for IT context:

Application in VPC-A wants db.dev.internal from VPC-B (in another account).
Create a Route 53 Resolver rule in VPC-A to forward .internal queries to VPC-B’s inbound endpoint.

4. Multi-Region DNS

AWS Route 53 supports global DNS resolution:

You can create private hosted zones in multiple Regions.
Or use Route 53 Resolver rules to forward queries to the correct Region.
Ensures applications in different Regions can resolve each other’s names, even if the IPs are private.

Exam tip:

Understand that private hosted zones are regional, but they can be associated with VPCs across accounts and Regions using RAM and Resolver rules.

5. Summary: Key Things to Remember for the Exam

VPC DNS – every VPC has a resolver at VPC CIDR +2.
Private Hosted Zones – used for internal names; must be associated with VPCs.
DNS Resolution Across VPCs:
- VPC Peering: enable DNS from peers.
- Transit Gateway: use Route 53 Resolver rules.
- Multi-account: share private hosted zones via AWS RAM.
Route 53 Resolver Endpoints – enable cross-VPC, cross-account, or on-prem name resolution.
Multi-Region DNS – forward queries or replicate private hosted zones.

Exam Tips

Always ask yourself: “Where does the client live? Where does the service live?” – this determines which DNS mechanism is needed.
Memorize which combinations require Route 53 Resolver rules, VPC peering DNS, or RAM sharing.
Know that Private Hosted Zones are not global by default.