Lecture 71: VPC Endpoint architectures - Accessing from on-premises network
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:55
- 来源：Udemy Lecture 50324653
- Slide 数量：3
- 画面切换：00:45、00:59
扫描说明
逐条检查了 Udemy 页面中的 44 条 Transcript cue，并对全长约 02:55 的视频画面进行扫描。同一架构页按基础可达性、endpoint-url 命令问题和 Route 53 Inbound Resolver 完整方案三个阶段拆分，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. On-premises 到 Interface Endpoint 的私有可达性
时间范围：00:00–00:45
总结 / Summary
中文
本地网络（on-premises network）通过站点到站点 VPN（Site-to-Site VPN）或专线（AWS Direct Connect）连接到 Endpoint VPC。只要路由可达，客户端可访问 Endpoint ENI 私有 IP；AWS 生成的 Endpoint DNS 也能在公网 DNS 中解析到该私有 IP，因此数据面连接可以建立。
English
The on-premises network connects to the endpoint VPC through Site-to-Site VPN or AWS Direct Connect. With correct routing, clients can reach endpoint ENI private IPs; AWS-generated endpoint DNS is publicly resolvable to those private IPs, so the data-plane connection can work.
Transcript
00:00 Okay.
00:01 Now this is very similar architecture to what we have seen earlier, just that this remote network is
00:06 not inside AWS, it is outside of AWS.
00:09 So you want to access the VPC endpoint through the VPN or Direct Connect, which is connected to your
00:15 on premises network.
00:17 Now again, with respect to layer three connectivity, there is this connectivity.
00:21 So as long as you can access this private IP address or the VPC endpoint DNS, you can access the VPC
00:28 endpoint services.
00:29 Right.
00:30 So let's start again.
00:32 So if you have the VPC DNS it will be resolved from the on premises because it can be resolved publicly.
00:39 But as you know it will resolve to the private IP address of the interface endpoint.
00:43 And the connectivity should work.
2. endpoint-url Workaround 仍不理想
时间范围：00:45–00:59
总结 / Summary
中文
本地应用可以在每条 AWS CLI 命令中指定 --endpoint-url 来使用 Endpoint DNS，但这要求修改应用或命令，不是透明访问方案。目标仍是让标准 AWS Service DNS 自动解析到私有 Endpoint。
English
An on-premises application can specify --endpoint-url in every AWS CLI command to use endpoint DNS, but this requires application or command changes and is not transparent. The desired outcome is for the standard AWS service hostname to resolve automatically to the private endpoint.
Transcript
00:45 But the same problem, right?
00:47 You don't want to add that endpoint URL to your commands when you fire that from your on premises host,
00:54 right?
00:55 That's not desirable.
00:57 So what do you do now?
3. Route 53 Inbound Resolver 与 DNS Forwarder
时间范围：00:59–02:55
总结 / Summary
中文
本地网络不能直接关联 Route 53 私有托管区（Private Hosted Zone）。应在 VPC 中部署 Route 53 Resolver 入站端点（Inbound Resolver Endpoint），并在本地 DNS Forwarder 上为目标服务域名配置条件转发（conditional forwarding）到 Inbound Endpoint IP。Resolver 使用 Private Hosted Zone 把标准服务名解析到 Endpoint DNS，再返回 Endpoint ENI 私有 IP；应用随后经 VPN 或 Direct Connect 访问 PrivateLink 服务。
English
An on-premises network cannot be directly associated with a Route 53 Private Hosted Zone. Deploy a Route 53 Resolver Inbound Endpoint in the VPC and configure conditional forwarding on the on-premises DNS forwarder for the service domain to the inbound endpoint IPs. The resolver uses the Private Hosted Zone to map the standard service name to endpoint DNS and then to endpoint ENI private IPs, after which the application reaches the PrivateLink service over VPN or Direct Connect.
Transcript
00:59 Now in this case, we can't follow the same approach as previous because in that case, we had associated
01:06 the private hosted zone with VPC because VPC is a AWS construct, right?
01:11 And as you know, this DNS cannot be directly resolved from the on premises network.
01:16 So what do you do for that?
01:17 For that you have to create route 53 inbound resolver endpoint.
01:22 And we have covered that in detail in the route 53 section.
01:26 So basically it allows you to send the DNS traffic to your VPC.
01:31 And if your VPC has a private hosted zone, it will also resolve the DNS from that private hosted zone.
01:38 So now as you have the route 53 inbound resolver, you should also configure the DNS forwarder on your
01:46 side, which sends all the requests for S3 dot AP South one dot Amazon Aws.com to this route 53 resolver
01:55 inbound endpoint IP address.
01:57 Okay.
01:58 So you would have that.
01:59 And then your on premise server will get the DNS resolution using this DNS forwarder.
02:05 And it will get the DNS of the interface endpoint, which will further be resolved to the private IP
02:13 of this interface endpoint.
02:15 And finally, your on premise server can access the VPC endpoint privately over a DX or a VPN and ultimately
02:25 can access the VPC endpoint service.
02:28 So in order to enable this DNS, you need to have this route 53 inbound resolver endpoint.
02:35 Right.
02:35 So that's another architecture.
02:38 And those are the things that you need to take care if you are allowing access to your interface endpoints
02:44 from the remote host, which is hosted outside of AWS.
02:48 So I hope it is clear.
02:50 And with that, now let's go to the next architecture.
02:53 Thank you.
整讲总结 / Overall Summary
中文
从 On-premises 访问 Interface Endpoint 时，IP 路由通常通过 VPN 或 AWS Direct Connect 解决，真正的难点是透明 DNS。标准方案是自建 Private Hosted Zone，并用 Route 53 Resolver Inbound Endpoint 接收本地 DNS Forwarder 的条件转发请求，使服务主机名解析到 Endpoint ENI 私有 IP。
English
For on-premises access to an Interface Endpoint, VPN or AWS Direct Connect usually solves IP routing; transparent DNS is the key challenge. The standard design uses a customer-managed Private Hosted Zone and a Route 53 Resolver Inbound Endpoint that receives conditionally forwarded queries from the on-premises DNS forwarder, causing service hostnames to resolve to endpoint ENI private IPs.
返回顶部 ↑