Lecture 66: Hands On: Accessing VPC endpoint service using Custom Domain Name (DNS)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:59
- 来源：Udemy Lecture 50330883
- Slide 数量：10
- 画面切换：00:46、01:12、01:57、02:40、02:53、03:18、03:50、04:34、04:53
扫描说明
逐条检查了 Udemy 页面中的 99 条 Transcript cue，并对全长 05:59 的视频画面进行扫描。依据架构与前提说明，以及 Provider Private DNS、Route 53 TXT 验证、Consumer Endpoint、解析验证和最终架构等阶段，共划分出 10 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 使用 Custom Domain Name 访问 Endpoint Service
时间范围：00:00–00:46
总结 / Summary
中文
上一讲使用 AWS 自动生成的 Endpoint DNS；本讲改用 app.example.com 一类自定义域名（custom domain name）。提供方必须拥有并验证域名，在 VPC Endpoint Service 上配置私有域名（private domain name），同时在使用者 Interface Endpoint 上启用私有 DNS（Private DNS）。
English
The previous lab used AWS-generated endpoint DNS; this lecture switches to a custom domain such as app.example.com. The provider must own and verify the domain, configure it as the private domain name of the VPC Endpoint Service, and enable Private DNS on the consumer Interface Endpoint.
Transcript
00:00 Okay, now let's try something interesting.
00:02 Now, in the previous exercise, you access the VPC endpoint service using the DNS that is given by
00:09 AWS, right?
00:09 That DNS or original DNS from this client.
00:13 Right.
00:14 Now what if we want to use custom domain name for example say app dot example.com.
00:19 Now if you have to do that first thing you need to own that example.com domain.
00:24 And you have to prove the domain ownership.
00:26 And then uh if you want to use that domain or a subdomain, you have to enable the private domain name
00:34 for the VPC endpoint service.
00:36 And also you have to enable that in the consumer VPC.
00:39 Right.
00:40 So for this to happen you have to enable the private DNS for the VPC endpoint service.
2. Private Domain Name 的必要条件
时间范围：00:46–01:12
总结 / Summary
中文
要使用私有域名，提供方 Endpoint Service 和使用者 VPC Endpoint 都要启用 Private DNS。使用者 VPC 必须启用 DNS 主机名（DNS hostnames）与 DNS 支持（DNS support），并且提供方必须能够证明自己拥有该域名。
English
Private DNS must be enabled on both the provider Endpoint Service and the consumer VPC endpoint. The consumer VPC must enable DNS hostnames and DNS support, and the provider must be able to prove ownership of the domain.
Transcript
00:46 Same for the VPC endpoint.
00:48 In the consumer VPC and VPC label, you have to enable the DNS hostname and enable DNS support, right?
00:56 And as I said, domain should be owned by you.
00:59 So that is also a prerequisite.
01:01 So let's try to do that.
01:03 And here I already have a domain name that I had purchased.
01:07 And I have that in a route 53.
01:10 So let's see how to do this.
3. 为 Endpoint Service 设置 Private DNS Name
时间范围：01:12–01:57
总结 / Summary
中文
在 Endpoint Service 的 Modify private DNS name 中设置自有域名的子域，例如 app.awstrainingcenter.com。AWS 随即生成域名所有权验证所需的 TXT 记录名称和值。
English
A subdomain of the owned domain, such as app.awstrainingcenter.com, is configured through Modify private DNS name on the Endpoint Service. AWS then generates the TXT record name and value required for domain-ownership verification.
Transcript
01:12 Okay.
01:12 So let's go to the VPC and the endpoint services.
01:16 And in here we have to modify the private DNS and let's say private DNS name say app dot I have a domain
01:25 name that's here.
01:27 That is AWS Training center.com that I had created in the past.
01:31 So I'll use the same domain name as a sub domain.
01:35 Basically app dot this.
01:37 So let's save the changes.
01:40 And now we need to verify this domain ownership.
01:43 So let's go here and verify the domain ownership.
01:47 And here for verifying the domain ownership we need to create this text record.
01:52 And this will be the key and this will be the value.
01:55 So let's go to the route 53.
4. 在 Route 53 创建 TXT 验证记录
时间范围：01:57–02:40
总结 / Summary
中文
在对应 Route 53 公有托管区（Public Hosted Zone）中创建 AWS 提供的文本记录（TXT record），然后触发 Verify domain ownership。验证可能需要数分钟。
English
The TXT record supplied by AWS is created in the corresponding Route 53 Public Hosted Zone, after which Verify domain ownership is initiated. Verification can take several minutes.
Transcript
01:57 And this is my hosted zone.
01:59 So let's create a record.
02:02 And, uh, the record type should be text and name should be this and value should be this.
02:13 Okay.
02:14 So that's done.
02:16 And let's create the record.
02:18 Now once that is done let's verify that.
02:22 And it says that it may take up to ten minutes for verification process.
02:26 So let's wait.
02:30 Okay.
02:31 So I'll wait for maybe a couple of minutes and I'll come back here and I'll see if the verification
02:38 is done or not.
02:40 Okay.
5. 确认 Domain Verification 为 Verified
时间范围：02:40–02:53
总结 / Summary
中文
Endpoint Service 的域名验证状态变为 Verified，说明提供方已成功证明域名所有权。至此提供方侧的 Private DNS 配置完成。
English
The Endpoint Service's domain-verification status changes to Verified, confirming that the provider has proven ownership of the domain. Provider-side Private DNS configuration is now complete.
Transcript
02:40 So it took around three minutes.
02:42 And you can see that the domain verification is verified.
02:45 So this is what we want.
02:47 Okay.
02:48 So that's done on the service provider side.
02:50 Now let's go to the EC2 console first.
6. 启用 Consumer Private DNS 前的失败测试
时间范围：02:53–03:18
总结 / Summary
中文
客户端首次访问自定义域名失败，因为使用者 Interface Endpoint 尚未启用私有 DNS（Private DNS），且该名称没有公共 DNS 记录。此测试确认仅验证 Provider Domain 并不足以完成解析。
English
The client's first request to the custom domain fails because Private DNS is not yet enabled on the consumer Interface Endpoint and no public DNS record exists. This proves that provider-domain verification alone does not complete resolution.
Transcript
02:53 And let's try to see if we can access the application using the custom domain name so it appears training
03:02 center.com.
03:04 And it won't work, of course, because we haven't really enabled the private DNS, right?
03:10 And there is no public record for this.
03:13 So next thing let's go to the VPC endpoint that's in a consumer VPC.
7. 在 Consumer Endpoint 启用 Private DNS
时间范围：03:18–03:50
总结 / Summary
中文
在使用者 VPC Endpoint 上启用私有 DNS（Private DNS）并等待 Endpoint 恢复 Available。VPC 侧的 DNS hostnames 与 DNS support 已在前一实验中启用，因此无需重复配置。
English
Private DNS is enabled on the consumer VPC endpoint and the endpoint is allowed to return to Available. DNS hostnames and DNS support were already enabled on the VPC in the previous lab, so no further VPC change is needed.
Transcript
03:18 And here let's enable the private DNS.
03:23 So let's enable for this endpoint and save the changes.
03:27 And as I said for this to happen the VPC should have the enable hostname and DNS.
03:35 True.
03:35 Right.
03:36 And that we had done in the previous exercise itself.
03:39 That's where we don't need to do it again.
03:42 So let's wait for this status to be available basically.
03:46 And we will then test the connectivity.
03:49 Okay.
8. Endpoint 自动继承 Provider Private DNS Name
时间范围：03:50–04:34
总结 / Summary
中文
Endpoint 变为 Available 后，会自动显示提供方 Endpoint Service 设置的私有 DNS 名称（private DNS name），无需在使用者侧再次输入。AWS 把该名称与当前 Endpoint 关联。
English
After the endpoint becomes Available, it automatically displays the private DNS name configured on the provider Endpoint Service; the consumer does not enter it again. AWS associates that name with this endpoint.
Transcript
03:50 So it took around 4 to 5 minutes for this endpoint to be available.
03:55 And at this time I expect that everything is done.
03:59 So if I go to my EC2 instance session, I should be able to resolve apt AWS training center.com.
04:08 And one more thing that you should see is that it automatically detected this private DNS name for the
04:15 endpoint in the endpoint.
04:16 We never told about this, right?
04:18 It was set at the endpoint services.
04:21 But because this endpoint is for this particular service, it automatically gets that private DNS name
04:28 right.
04:28 So with that now let's go to this and let's try this again.
9. 验证 Custom DNS 解析与应用访问
时间范围：04:34–04:53
总结 / Summary
中文
客户端现在可通过自定义域名访问 Web 服务。nslookup 返回两个 Endpoint ENI 的私有 IP，证明域名解析已经指向使用者 VPC 中的 Regional Endpoint DNS。
English
The client can now access the web service through the custom domain. nslookup returns the private IPs of the two endpoint ENIs, proving that the name resolves through the Regional Endpoint DNS inside the consumer VPC.
Transcript
04:34 And you can see that we are able to access the service.
04:38 In fact if you do nslookup with app dot.
04:44 This domain name then it resolves to the both the IPS basically for the endpoint DNS right.
10. Private Hosted Zone 解析机制与清理
时间范围：04:53–05:59
总结 / Summary
中文
AWS 在使用者 VPC 中建立同名的私有托管区（Private Hosted Zone），其中记录指向 VPC Endpoint 的区域 DNS（Regional DNS），再解析到多个 ENI 私有 IP。实验结束后应删除 Endpoint、Endpoint Service、NLB 和 EC2 等计费资源。
English
AWS creates a same-named Private Hosted Zone for the consumer VPC whose record targets the VPC endpoint's Regional DNS, which then resolves to the private IPs of the endpoint ENIs. After the lab, delete billable resources such as the endpoint, Endpoint Service, NLB, and EC2 instances.
Transcript
04:53 So ultimately what AWS does is it creates a private hosted zone with the same domain name that is app.com,
05:03 and in that it creates the key name which points to the regional, uh, DNS of the VPC endpoint.
05:11 And that's where you see both the IPS being given because we are trying to resolve the DNS.
05:16 So this is how it works.
05:18 So I hope you are also able to do that.
05:21 And if not you are able to at least follow what we did.
05:25 So here we basically use the VPC endpoint service using our own domain name.
05:31 Right.
05:32 So I hope you enjoyed this two exercises.
05:36 And with that we are very close.
05:37 To wrap up VPC private link section.
05:40 Uh, we'll cover some additional architectures.
05:43 And then we will move to the next section.
05:45 But before we stop, please remember that you have to delete all the resources that you created in this
05:52 two exercises.
05:54 Right.
05:54 So with that we'll stop here and let's go to the next lecture.
05:57 Thank you.
整讲总结 / Overall Summary
中文
本讲把上一讲的 Endpoint Service 扩展为自定义域名访问：Provider 在 Endpoint Service 上设置私有 DNS 名称并通过 Route 53 TXT 记录证明域名所有权，Consumer 在 Interface Endpoint 上启用 Private DNS。AWS 随后利用 Private Hosted Zone 把自定义名称映射到 Regional Endpoint DNS 与 ENI 私有 IP，使客户端无需 AWS 自动生成的主机名即可私有访问服务。
English
This lecture extends the previous Endpoint Service with a custom domain. The provider configures a private DNS name and proves ownership with a Route 53 TXT record, while the consumer enables Private DNS on the Interface Endpoint. AWS then uses a Private Hosted Zone to map the custom name to the Regional Endpoint DNS and endpoint ENI private IPs, allowing private service access without the AWS-generated hostname.
返回顶部 ↑