Lecture 34: Hands On: VPC DNS with Route53 Private Hosted zone
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:59
- 来源：Udemy Lecture 26072698
- Slide 数量：9
- 画面切换：00:15、01:27、01:53、02:57、03:34、04:29、05:03、05:45
扫描说明
按 Udemy Transcript 的 117 个时间点逐一定位并比较视频画面，确认 3 个正式 Slide，并把 AWS 控制台与 SSH 演示按配置目标拆为 6 个稳定阶段，共 9 小节。截图保留完整视频区域与各阶段的关键完成状态。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC DNS with a Route 53 Private Hosted Zone
时间范围：00:00–00:15
总结 / Summary
中文
本实验在 VPC 内使用 Route 53 私有托管区域（Private Hosted Zone）实现自定义私有 DNS（Private DNS），并验证实例之间能够通过名称通信。
English
This lab implements custom private DNS inside a VPC with a Route 53 Private Hosted Zone and verifies name-based communication between instances.
Transcript
00:00 Hi.
00:00 So in this exercise, let's try to see how the private DNS works for the VPC using route 53 private
00:08 hosted zone.
00:09 So our setup will look something like this where we have VPC and then corresponding subnets.
2. Target Architecture and Resolution Flow
时间范围：00:15–01:27
总结 / Summary
中文
架构包含公有子网中的应用实例和私有子网中的数据库实例。DHCP 选项集（DHCP Option Set）保留 AmazonProvidedDNS，可选地把搜索域改为 corp.internal；同名 Route 53 私有托管区域（Private Hosted Zone）保存 app 与 db 记录，查询由 VPC+2 的 Route 53 解析器（Route 53 Resolver）完成。
English
The architecture places an application instance in a public subnet and a database instance in a private subnet. The DHCP option set keeps AmazonProvidedDNS and optionally changes the search domain to corp.internal. A matching Route 53 Private Hosted Zone stores the app and db records, resolved by the VPC+2 Route 53 Resolver.
Transcript
00:15 And in that we need two EC2 instances one as app server and one as the DB server.
00:21 Now we want to use Amazon provided DNS server.
00:24 So we are not going to change anything in the Dhcp option set as a name server.
00:30 But because we want our domain name to be core dot internal, then we will create a new option set where
00:37 we'll just change this domain name.
00:39 And then we will associate this Dhcp option set to the VPC.
00:45 And to be honest, changing this domain name to CORBA internal in the Dhcp option set is optional and
00:52 I will talk about that while we implement it, but that's what the Dhcp option set will look like.
00:58 And then the most important part here is to create the private hosted zone with the same name as our
01:03 domain name that is corp dot internal.
01:06 And then we'll create corresponding record sets in that with the app and db server pointing to corresponding
01:12 EC2 instances.
01:13 And then from this app server, we will try to reach to the DB server using its DNS name.
01:20 And then the DNS resolution will happen using this flow.
01:24 Right.
01:24 So that's what we are going to implement.
3. Implementation Steps
时间范围：01:27–01:53
总结 / Summary
中文
步骤依次为：准备 VPC 与公有/私有子网，创建并关联 DHCP 选项集（DHCP Option Set），分别启动应用与数据库 EC2 实例，创建并关联 Route 53 私有托管区域（Private Hosted Zone），添加指向实例私有 IP 的记录，最后从应用实例按 DNS 名称访问数据库实例。
English
The steps are to prepare a VPC with public and private subnets, create and associate a DHCP option set, launch application and database EC2 instances, create and associate a Route 53 Private Hosted Zone, add records for the private IPs, and test database access by DNS name from the application instance.
Transcript
01:27 I have also listed all these steps here.
01:29 So you can also just look at these steps and try to implement on your own.
01:34 Now to save some time, I have already created the VPC and created a public and private subnet.
01:40 But let's now create the next step that is Dhcp option set and then launch this EC2 instances and then
01:47 create the Route53 private hosted zone.
01:50 So let's do that now.
4. Create and Associate the DHCP Option Set
时间范围：01:53–02:57
总结 / Summary
中文
从默认选项集复制 AmazonProvidedDNS 字符串，新建域名为 corp.internal 的 DHCP 选项集（DHCP Option Set），其余参数保持默认，然后将其关联到实验 VPC。修改域名主要为了让 corp.internal 成为客户端搜索域（Search Domain），并不是私有托管区域解析本身的必需条件。
English
The lab copies the AmazonProvidedDNS value from the default set, creates a DHCP option set with domain corp.internal, keeps the remaining values at their defaults, and associates it with the VPC. Changing the domain mainly establishes the client search domain; it is not required for fully qualified Private Hosted Zone lookups.
Transcript
01:53 So you can see I have a VPC.
01:54 And then it has two subnets as of now public and private.
01:58 And that's it right.
02:00 So now the next thing that we want to do is we want to create a Dhcp option set.
02:06 So this is a default one.
02:07 What we really need is this server because we want to keep the same server as Amazon provided DNS.
02:13 So let's create a new Dhcp option set.
02:16 And let's call it say corp dot internal because that's the name that we want to use.
02:24 And same here.
02:25 Now the most important part here is use this string because it points to route 53 resolver and rest
02:34 of the setting.
02:35 You can just keep as it is and that's it.
02:38 Right.
02:39 But you have to also associate this with your VPC.
02:43 So let's go to the VPC and just modify this to the corp dot internal.
02:52 And that's it.
02:53 Let's save it.
02:55 So we are done with the VPC settings.
5. Create the Private Hosted Zone
时间范围：02:57–03:34
总结 / Summary
中文
在 Route 53 中创建 corp.internal 私有托管区域（Private Hosted Zone），选择私有区域类型，并把它关联到 Mumbai 区域中的实验 VPC。DNS 记录稍后在取得实例私有 IP 后添加。
English
A corp.internal Private Hosted Zone is created in Route 53, configured as private, and associated with the lab VPC in the Mumbai Region. Records are added later after the instances' private IP addresses are known.
Transcript
02:57 And next we want to go to the route 53.
03:00 And if you go to the route 53 there are hosted zones.
03:04 So we want to create a new private hosted zone.
03:07 So let's say create a hosted zone with the same name as Corp Dot internal.
03:12 And it's a private one.
03:13 So you have to associate that with your VPC in the Mumbai region.
03:19 So this is my VPC and let's create that.
03:23 Now we'll again come back here when we launch EC2 instances.
03:27 Because for creating these records here we will need private IP addresses of the EC2 instances.
6. Launch the Public Application Instance
时间范围：03:34–04:29
总结 / Summary
中文
应用 EC2 实例（Application Instance）启动在公有子网（Public Subnet），启用公有 IP 以便通过 SSH 登录。安全组（Security Group）允许来自操作者 IP 的 SSH，并允许 VPC CIDR 10.0.0.0/16 内的 ICMP，用于实例间 ping 测试。
English
The application EC2 instance is launched in a public subnet with a public IP for SSH access. Its security group permits SSH from the operator's IP and ICMP from the VPC CIDR 10.0.0.0/16 for instance-to-instance ping tests.
Transcript
03:34 So let's go here into the EC2.
03:37 And let's launch our public EC2 instance.
03:41 Let's call it app instance.
03:44 And I'm going with all the defaults, just that in the networking, make sure that you use your VPC,
03:52 and I want to launch it in a public subnet.
03:54 And I want to have a public IP because I'll be connecting to this instance over SSH to test the DNS
04:01 resolution.
04:03 Now with respect to the security group, you can create a new security group.
04:07 And you should allow the SSH from say my IP.
04:13 And also you should have all ICMP IPv4 from the VPC, Cidr itself.
04:19 That is ten .0.0.0 slash 16.
04:25 That's it.
04:26 And let's launch the instance.
7. Launch the Private Database Instance
时间范围：04:29–05:03
总结 / Summary
中文
数据库 EC2 实例（Database Instance）启动在私有子网（Private Subnet），不分配公有 IP，并复用刚创建的安全组（Security Group）。这样只有应用实例需要外部登录入口，而数据库通信留在 VPC 内。
English
The database EC2 instance is launched in a private subnet without a public IP and reuses the newly created security group. Only the application instance needs an external login path, while database traffic remains inside the VPC.
Transcript
04:29 Now.
04:29 Similarly, we also want to launch another instance but in a private subnet.
04:34 So let's launch that instance.
04:37 Let's call it a DB instance.
04:40 And.
04:42 Let's edit the VPC.
04:45 And in this case we want to launch it in a private subnet.
04:49 And we don't want a public IP.
04:51 However security group we can use the existing one that we just created.
04:55 And that's it.
04:56 Let's launch the instance.
04:59 Okay, so two instances are there app and db.
8. Create app and db DNS Records
时间范围：05:03–05:45
总结 / Summary
中文
在 corp.internal 私有托管区域（Private Hosted Zone）中创建 app.corp.internal 和 db.corp.internal 记录，分别指向两台实例的私有 IP。Route 53 解析器（Route 53 Resolver）随后能为关联 VPC 内的客户端返回这些地址。
English
The corp.internal Private Hosted Zone receives app.corp.internal and db.corp.internal records pointing to the instances' private IPs. The Route 53 Resolver can then answer these names for clients in the associated VPC.
Transcript
05:03 They will come up soon.
05:04 And rest of the things we are already done with.
05:09 Now last thing we want to do is to use their private IP address to create the record sets in the route
05:16 53 hosted zone.
05:17 So this one is for the app.
05:19 So let's go here.
05:20 Let's create a record and let's say app dot Corp dot internal points to this particular private IP.
05:29 And similarly we need to do that for DB instance.
05:32 So let's go here pick its private IP.
05:35 Let's go here.
05:36 Let's create a record say DB dot corp dot internal points to this IP.
05:44 Right?
05:44 As simple as that.
9. Verify FQDN and Short-Name Resolution
时间范围：05:45–07:59
总结 / Summary
中文
通过应用实例的公有 IP 建立 SSH 会话后，/etc/resolv.conf 显示名称服务器为 VPC+2 地址、搜索域为 corp.internal。ping db.corp.internal 成功解析到数据库私有 IP；由于搜索域已配置，简写 ping db 也会自动补全并解析。如果不修改 DHCP 域名，完全限定域名（Fully Qualified Domain Name, FQDN）仍可工作，但简写 db 会追加区域默认域名而失败。实验后应终止实例以避免费用。
English
After SSHing to the application instance, /etc/resolv.conf shows the VPC+2 name server and corp.internal search domain. ping db.corp.internal resolves to the database's private IP, and the short command ping db also works because the search suffix is appended. Without the DHCP domain change, the fully qualified name would still resolve, but short db would receive the default Region suffix and fail. The instances should be terminated after the lab to avoid charges.
Transcript
05:45 Now let's go to our instances and pick the public IP of this instance and let's SSH into it.
05:55 So this is my Mumbai session with the Mumbai key and I'm putting the public IP.
06:04 And I'm just logging in here.
06:09 Done.
06:09 Let's also look at a few settings like cat, etc. Resolvconf and you will see that the search domain
06:19 is coreboot internal here, and the name server is ten .0.0.2, which means if I do now ping dot db,
06:28 dot core, dot internal, it should go to my database server.
06:34 You can see very well it is doing the same.
06:36 So this is now being resolved using the route 53 private hosted zone.
06:41 Now also as my search domain is core dot internal, I can also do ping db and it still resolves because
06:50 it is looking at this particular domain name.
06:53 Now that's the thing where I said it's optional to configure this into the Dhcp option set.
07:01 If you don't change this into the Dhcp option set then it will be AP South one dot compute dot internal.
07:09 And then if you say ping db it will ping to db dot AP south one dot compute dot internal.
07:16 And it won't then resolve because in route 53 hosted zone you don't have that domain name.
07:23 But now because we added core dot internal in the Dhcp option set, you don't even have to define the
07:29 fully qualified domain name here.
07:31 Just DB works.
07:33 Right.
07:33 So this is just another thing that you need to understand.
07:37 Right.
07:38 So that's what our exercise was and it was pretty simple.
07:42 Now if you are also doing this exercise, please don't forget to terminate your instances because you
07:48 may be charged for that.
07:50 So thanks for watching.
07:51 And in the next lecture we are going to set up our own custom DNS server and let's see how that works.
整讲总结 / Overall Summary
中文
本实验完整验证了 Route 53 私有托管区域（Private Hosted Zone）的 VPC 内解析链路：DHCP 选项集（DHCP Option Set）分发 AmazonProvidedDNS 与搜索域，私有区域保存名称到私有 IP 的记录，应用实例最终可通过 FQDN 或短名称访问私有数据库实例。
English
The lab validates the complete VPC private-resolution path: the DHCP option set distributes AmazonProvidedDNS and a search domain, the Private Hosted Zone stores name-to-private-IP records, and the application instance reaches the private database by either FQDN or short name.
返回顶部 ↑