Lecture 62: VPC endpoint DNS
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:59
- 来源：Udemy Lecture 50324613
- Slide 数量：6
- 画面切换：00:14、02:59、04:28、05:39、07:13
扫描说明
逐条检查了 Udemy 页面中的 122 条 Transcript cue，并对全长 07:59 的视频画面进行扫描。除标题、概念说明与总结页外，架构图按公共解析、Endpoint 专用 DNS 和 Private DNS 三个实质性阶段拆分，共划分出 6 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Endpoint DNS 导论
时间范围：00:00–00:14
总结 / Summary
中文
本节引入 VPC 端点域名系统（VPC Endpoint Domain Name System, DNS），并强调理解端点名称如何解析到私有地址，是正确使用接口端点（Interface Endpoint）的关键。
English
This introduction presents VPC endpoint Domain Name System (DNS) and emphasizes that understanding how endpoint names resolve to private addresses is essential for using Interface Endpoints correctly.
Transcript
00:00 Okay, now let's look at another important thing about VPC endpoint that is VPC endpoint DNS.
00:06 And it is really crucial to understand how DNS works for VPC endpoints okay.
00:12 So let's get started.
2. 区域与可用区 DNS 名称
时间范围：00:14–02:59
总结 / Summary
中文
AWS 会为 VPC Endpoint 分配解析到端点弹性网络接口（Elastic Network Interface, ENI）私有 IP 的 DNS 名称，包括区域 DNS（Regional DNS）和每个可用区（Availability Zone, AZ）的可用区 DNS（Zonal DNS）。启用私有 DNS（Private DNS）后，AWS 服务原有的公共主机名也可在 VPC 内解析到端点 ENI；这要求 VPC 启用 DNS 主机名（DNS hostnames）和 DNS 支持（DNS support）。
English
AWS assigns DNS names that resolve to the private IPs of the endpoint Elastic Network Interfaces (ENIs), including one Regional DNS name and Zonal DNS names for each Availability Zone. With Private DNS enabled, the normal public hostname of an AWS service resolves inside the VPC to the endpoint ENI, provided DNS hostnames and DNS support are enabled on the VPC.
Transcript
00:14 Right.
00:14 So when you create the VPC endpoints basically AWS assigns a DNS name for that endpoint.
00:21 And that DNS name resolves to the private IP of that Eni that this endpoint creates.
00:27 So in the consumer VPC, basically you can also access the VPC endpoint using that DNS name.
00:33 Now in this case AWS creates two different types of DNS.
00:38 One is a zonal DNS and another type is regional DNS.
00:42 Zonal means per AZ.
00:44 It creates different DNS.
00:46 So if you create the VPC endpoint in two AZS, then there will be two zonal DNS, and there will be
00:52 then regional DNS.
00:53 And it will provide the IP addresses of those DNS across all the availability zones.
01:00 Right.
01:00 So there is this kind of regional DNS.
01:03 Now this is for example is for Athena service endpoint.
01:07 As you can see here, there is US East one.
01:10 So that's a regional one.
01:11 But additionally it creates the zonal one.
01:13 As you can see here US East one A that is in one of the availability zone.
01:19 Similarly if you have two AZS then there will be additional zonal DNS.
01:24 Now the way it works is from your client which is sitting in consumer VPC.
01:29 It need not send the traffic to the IP address.
01:32 Rather it can use this DNS to reach to the VPC endpoint.
01:37 And from that endpoint, traffic will go to the target service.
01:40 That service could be AWS service as we are talking about.
01:43 Or it can be your own service deployed in another VPC.
01:48 Right.
01:48 So that's how the DNS work.
01:50 And optionally you can also enable the private DNS for the endpoint.
01:55 Now what does that mean.
01:57 So let's take an example that you are creating the VPC interface endpoint for, say, SQS service,
02:03 right?
02:04 So it ultimately takes you to the SQS service endpoint, which AWS manages.
02:10 Now without private DNS, you would have to use this regional or zonal DNS to reach to the SQS service.
02:16 But if you enable the private DNS, then you can use the same public DNS name of the SQS service endpoint,
02:23 and it resolves to the private IP address of the endpoint inside your VPC, right.
02:28 So that means your client does not need to change anything.
02:31 They can just use the normal CLI or API call, and it will be resolved to the private IP address of
02:39 the VPC endpoint.
02:40 And it will go to the SQS service privately.
02:43 And for this to work you have to enable the DNS host name and DNS support for your VPC that we already
02:50 learned in the DNS section of the VPC.
02:54 So let's now try to understand this more Diagrammatically.
3. 禁用 Private DNS 时的公共解析路径
时间范围：02:59–04:28
总结 / Summary
中文
以 Amazon Kinesis 为例，禁用私有 DNS（Private DNS）后，应用若继续使用 Kinesis 的标准服务主机名，DNS 会返回服务公共端点（public service endpoint）的公共 IP，流量不会自动进入 PrivateLink。没有互联网网关（Internet Gateway, IGW）时，这条访问路径甚至无法建立。
English
Using Amazon Kinesis as the example, when Private DNS is disabled, an application that uses the standard Kinesis service hostname receives the public IP of the public service endpoint. Traffic does not automatically enter PrivateLink, and without an Internet Gateway (IGW) this path cannot reach the service at all.
Transcript
02:59 So assuming that you have a consumer VPC and you want to create the VPC endpoint for accessing Kinesis
03:04 service.
03:05 Right.
03:05 So you will create a VPC endpoint for Kinesis.
03:08 And it will create an Eni.
03:10 And it will have some private IP address from your VPC.
03:13 Now at this point, if this client, which could be EC2 instance, may want to access the Kinesis service
03:19 using the AWS CLI or SDK or API call.
03:23 Right.
03:24 And in that case it will use Kinesis Service endpoint.
03:26 Right.
03:27 So in this case let's first see when you disable the private DNS for the endpoint what happens.
03:33 Right.
03:33 So private DNS disabled.
03:35 And in that case you know that there will be zonal and regional DNS created for these endpoints.
03:41 So now if client makes an API call or CLI call to the Kinesis service, first the DNS should be resolved.
03:47 But because it's a public DNS for Kinesis service, it will return the public IP of the Kinesis Service
03:54 endpoint.
03:55 Right.
03:56 And traffic will go over other internet.
03:58 And if your VPC does not have internet gateway, this traffic won't even go to the Kinesis service.
04:04 So that's the problem when you, you know, disable the DNS and you are not using the VPC endpoint specific
04:12 DNS.
04:13 So this is just like accessing the Kinesis endpoint with a public DNS right.
04:19 So this won't work.
04:21 So with private DNS disabled the API or CLI calls to the AWS service endpoint resolves to the public
04:26 IP.
04:27 And this is what we want.
4. 手动使用 Endpoint 专用 DNS
时间范围：04:28–05:39
总结 / Summary
中文
在不启用 Private DNS 的情况下，客户端可显式使用端点专用 DNS 名称（endpoint-specific DNS name），使其解析到 VPC Endpoint ENI 的私有 IP，再通过 PrivateLink 访问 Kinesis。该方式可以工作，但应用、AWS CLI 或 SDK 必须改用自定义端点 URL（endpoint URL），增加了配置耦合。
English
Without Private DNS, the client can explicitly use the endpoint-specific DNS name so it resolves to the private IP of the VPC endpoint ENI and reaches Kinesis through PrivateLink. This works, but the application, AWS CLI, or SDK must be configured with a custom endpoint URL, adding configuration coupling.
Transcript
04:28 We want that we get the private IP of this Eni.
04:32 And then traffic goes through this private IP to the Kinesis.
04:36 Now for that what you can do instead of using the Kinesis Public endpoint DNS, you can use this VPC
04:44 endpoint DNS to connect to the Kinesis service.
04:47 So now your EC2 instance will make a DNS query.
04:52 But for this particular DNS right.
04:55 And it will resolve to the private IP of this VPC endpoint, and then traffic will go to the Kinesis
05:01 privately.
05:02 So this works right.
05:04 But this means that the application that you are running inside your EC2 needs to now use custom DNS
05:11 to reach to the Kinesis service.
05:13 Right.
05:13 So that's kind of not desirable.
05:17 So we can use the endpoint specific DNS name.
05:19 It resolves to the private IP.
05:20 But this is not desirable.
05:22 What is desirable is that my EC2 instance or application shouldn't be worrying about, you know, using
05:29 this DNS, but rather should use normal Kinesis DNS.
05:33 But it should resolve to the private IP of this Eni here.
05:38 So how do we do that?
5. 启用 Private DNS 与私有托管区
时间范围：05:39–07:13
总结 / Summary
中文
启用私有 DNS（Private DNS）后，AWS 自动创建并关联一个与服务公共主机名同名的 Route 53 私有托管区（Private Hosted Zone）。应用仍使用正常的 Kinesis 服务主机名，解析链会把它映射到 Endpoint DNS，最终返回 Endpoint ENI 的私有 IP，因此 API、AWS CLI 和 SDK 无需修改服务地址。
English
When Private DNS is enabled, AWS automatically creates and associates a Route 53 Private Hosted Zone matching the service's public hostname. Applications continue using the normal Kinesis service name; the resolution chain maps it to the endpoint DNS and ultimately returns the private IP of the endpoint ENI, so API, AWS CLI, and SDK calls need no endpoint change.
Transcript
05:39 So for that we have to enable the private DNS for Kinesis service.
05:44 And as you do that what AWS does it creates another private hosted zone in route 53 with the same name
05:52 as Kinesis Service Endpoint.
05:54 Because it's a private hosted zone and it associates that with your VPC automatically.
06:00 Now, as this happens now your client can make a request for the Kinesis Service public endpoint.
06:06 It first resolves to the VPC endpoint specific DNS.
06:11 And then again it makes a query and it resolves to the private IP of VPC endpoint.
06:17 Now your client can reach to the Kinesis service over this private link connection.
06:22 So this is what it means when we enable the private DNS for the VPC endpoint.
06:29 So with private DNS enabled application inside VPC using API or CLI or SDK do not need to change anything
06:36 for accessing AWS service.
06:38 But otherwise if you don't want to use the private DNS enabled, then if you are using aws CLI, you
06:45 have to append the additional parameters which says endpoint URL.
06:51 And then you would have to provide this particular VPC endpoint specific DNS.
06:55 And we will talk more about that as we do an exercise for this scenario, but otherwise I hope it is
07:02 clear now how the DNS work for VPC endpoint.
07:06 And also remember that there is original DNS and there are zonal DNS for every AZ.
6. VPC Endpoint DNS 要点总结
时间范围：07:13–07:59
总结 / Summary
中文
总结而言，启用 Private DNS 会让 AWS 服务的公共主机名经由私有托管区（Private Hosted Zone）解析到 VPC Endpoint DNS，再解析到 ENI 私有 IP。使用者 VPC 必须同时启用 DNS 主机名（DNS hostnames）与 DNS 支持（DNS support）；不同服务可能还具有不同的可用区 DNS（Zonal DNS）与区域 DNS（Regional DNS）命名格式。
English
In summary, Private DNS makes an AWS service's public hostname resolve through a Private Hosted Zone to the VPC endpoint DNS and then to the ENI's private IP. The consumer VPC must enable both DNS hostnames and DNS support, while the exact Regional and Zonal DNS naming pattern varies by service.
Transcript
07:13 Okay, so let's quickly summarize.
07:15 With private DNS enabled, the public hostname of AWS service resolves to the private endpoint interface
07:21 hostname, and then it creates the private hosted zone associated with your VPC.
07:27 And then it resolves to the VPC endpoint DNS.
07:30 And finally it resolves to the private IP of your Eni.
07:34 And for all this to work at consumer VPC level, the enable DNS hostname and enabled DNS support must
07:43 be true, right?
07:45 So just remember this.
07:46 And with this knowledge we are soon going to do an exercise for this scenario so that you can experience
07:53 it right.
07:54 So we'll stop here for this lecture and let's go to the next lecture.
07:57 Thank you.
整讲总结 / Overall Summary
中文
本讲解释了 Interface Endpoint 的完整 DNS 模型：AWS 为 Endpoint ENI 提供 Regional DNS 与 Zonal DNS；禁用 Private DNS 时，标准服务主机名仍解析到公共端点，必须显式指定 endpoint-specific DNS 才能走 PrivateLink；启用 Private DNS 后，Route 53 Private Hosted Zone 会透明地把标准服务主机名映射到 Endpoint ENI 的私有 IP。
English
This lecture explains the complete Interface Endpoint DNS model. AWS provides Regional and Zonal DNS names for endpoint ENIs. With Private DNS disabled, standard service hostnames still resolve to public endpoints, so clients must explicitly use endpoint-specific DNS to traverse PrivateLink. With Private DNS enabled, a Route 53 Private Hosted Zone transparently maps the standard service hostname to the endpoint ENI's private IP.
返回顶部 ↑