Lecture 214: Common Route 53 scenarios
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:30
- 来源：Udemy Lecture 28556463
- Slide 数量：7
- 画面切换：01:32、02:54、04:23、05:06、05:29、06:04
扫描说明
逐条读取了 Udemy 页面中的 160 条英文 Transcript cue，并按时间轴扫描全长约 06:30 的视频。依据 EC2 DNS 的内外网分裂解析、原生 DNS 验证、CNAME Hands-on、ALB/CloudFront、API Gateway/RDS、S3 Website、PrivateLink Interface Endpoint 划分为 7 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. EC2 Public DNS 会按查询位置返回 Public 或 Private IP
时间范围：00:00–01:32
总结 / Summary
中文
Route 53 的 A Record 可以直接指向 EC2 Public IP 或 Elastic IP；若希望使用 EC2 自带的 Public DNS Name，则必须创建 CNAME，不能用 Alias。这个 EC2 DNS Name 具有 Split-horizon 行为：从 AWS 外部查询返回 Public IPv4，从同一 VPC 内部查询返回 Private IPv4，因此同一个应用域名可自动采用合适的网络路径。
English
A Route 53 A record can point directly to an EC2 public or Elastic IP. To use the instance's AWS-provided public DNS name, create a CNAME because an alias cannot target an EC2 instance DNS name. That hostname has split-horizon behavior: queries outside AWS receive the public IPv4 address, while queries inside the VPC receive the private IPv4 address.
Transcript
00:00 Okay,
00:01 so now let's talk about a few scenarios you can find
00:03 with Route 53.
00:05 And the first one is for an EC2 instance.
00:06 So we can, for example, create a record,
00:09 an A record that points to a specific,
00:11 for example,
00:12 a public IP or an elastic IP of an EC2 instance,
00:16 this is very simple.
00:17 Now, it becomes a little bit trickier
00:19 and there's something that you need to know about this,
00:20 when you want to point to a DNS name of an EC2 instance.
00:24 So why would you do so why would you point a record
00:27 into a CNAME of an EC2 instance.
00:30 Well, the idea is that's, for example,
00:31 if you take EC2 instance and you create it
00:34 on your cloud, then it has two IP, right?
00:37 It has its public IP, and it has its private IP,
00:40 but it only has one public DNS name.
00:44 And the idea is that this DNS name is a bit special.
00:47 So this DNS name will send you to the public IPv4
00:51 if you created it from outside of AWS.
00:54 And will give you the result of a private IPv4,
00:57 if you create from inside of AWS,
01:01 that means that we can not create an alias record on this,
01:03 by the way, we can only create a CNAME record.
01:05 So, if we create a CNAME record
01:08 for the value of being the DNS name of the EC2 instance,
01:12 then a clients from outside of AWS,
01:15 when requesting app.example.com will eventually resolve
01:19 to the public IP of the EC2 instance,
01:22 but an Institute instance, for example,
01:24 or anything within your VPC
01:26 that uses the same app.example.com
01:28 will resolve to the private IP of that EC2 instance.
2. 同一 EC2 DNS Name：VPC 内 dig 得 Private IP，外部得 Public IP
时间范围：01:32–02:54
总结 / Summary
中文
实例详情同时显示 Private IPv4、Public IPv4，却只有一个 Public IPv4 DNS。课程从 EC2 Instance Connect 中 dig 该 DNS Name，Answer 返回 172.31.x.x 的 Private IP；再从网络视角位于外部的 CloudShell 查询，同一名称返回 3.70.x.x 的 Public IP。实验验证了 AWS DNS 对查询来源的不同应答。
English
The instance details show both private and public IPv4 addresses but only one public IPv4 DNS name. A dig from EC2 Instance Connect returns the 172.31.x.x private address, while the same query from CloudShell, treated as external from a network perspective, returns the 3.70.x.x public address. This validates source-dependent AWS DNS answers.
Transcript
01:32 So let's verify this right now.
01:35 So if I have a look at my EC2 instance right here,
01:37 as you can see,
01:38 there is a private IPv4 address and a public IPv4 address,
01:42 and there's only one public IPv4 DNS.
01:45 So, we'll copy this
01:48 public IPv4 DNS, okay?
01:50 And I'm going to connect
01:51 to my instance using EC2 instance connects.
01:57 And so if I do a dig command,
01:59 if it is installed, let's see, yes, dig is installed
02:01 so I will clear my screen.
02:02 If I do a dig commands on this DNS, as we can see,
02:06 the result we get from the answer section is 172 at 31,
02:09 which is the private IP domain space.
02:12 So from within my VPC,
02:14 this IP address resolves,
02:16 this DNS resolved to the private IP address, right?
02:19 But if I take cloud shell, for example,
02:20 this is considered as a public one
02:23 from a network perspective.
02:24 So if I do a dig on
02:26 and I will have to copy the exact same DNS name, of course.
02:30 So let's copy it from here.
02:36 Okay?
02:36 So if I do a dig at this time
02:38 on the same obviously DNS name,
02:40 the result is going to be different.
02:41 Now the insert section is saying,
02:42 that's the resolve is,
02:44 resolving is 3.70.14.223.
02:47 So that means that it has the same DNS name,
02:50 got us both a public IP from outside
02:52 and a private IP from inside.
3. Route 53 CNAME 保留 EC2 DNS 的内外网解析特性
时间范围：02:54–04:23
总结 / Summary
中文
为 ec2.stephanetheteacher.com 创建 CNAME，Value 填 EC2 Public DNS Name，并使用 Simple Routing。VPC 内 dig 先看到自定义名称 CNAME 到 EC2 DNS，再得到 Private IP；外部执行相同查询则得到同一 CNAME 后的 Public IP。Route 53 只增加友好名称，并未破坏底层 Split DNS 行为。
English
Create ec2.stephanetheteacher.com as a CNAME whose value is the EC2 public DNS name, using simple routing. Inside the VPC, dig follows the CNAME and obtains the private address; outside, the same CNAME chain ends at the public address. Route 53 adds a friendly name without changing the underlying split-DNS behavior.
Transcript
02:54 And we can also verify this with the records,
02:57 so if you create a record and this will, I call it EC2.
03:01 As we can see, it has to be a CNAME.
03:03 It could not be an alias,
03:04 if you want you to have an alias.
03:05 So CNAME alias only works for other records,
03:08 but if it wasn't A record, for example,
03:10 there is no, EC2 DNS name you can choose from here. Okay.
03:13 So alias is not possible to an EC2 instance
03:16 for this you have to use a CNAME.
03:19 And then for the CNAME, we'll remove the alias.
03:22 For the CNAME, the value has
03:23 to be obviously this DNS name right here.
03:26 So if I paste that in, okay, and we're good to go
03:29 and we are just doing a simple routing
03:31 and create this record.
03:36 Okay.
03:37 So now what's going to happen is that I'm going to just try
03:39 to do a DNS query against this record.
03:42 So I will do dig, EC2 dot
03:45 (typing)
03:47 and here we go, press enter.
03:49 And as you can see, now we can look at how it's resolved.
03:51 So this, was resolved as a CNAME for the public IPv4 DNS
03:56 of my EC2 instance.
03:57 And then one of them were down in one to two V private IP.
04:01 But if I do the exact same command here,
04:03 so I clear the screen and repeat this command, oops,
04:06 clear the screen.
04:08 And then do a dig on EC2 that's in my domain name.
04:12 (typing)
04:13 As we can see, we have the CNAME that's exactly the same
04:17 but now when this gets resolved,
04:19 it gets resolved to the public IPv4 of my EC2 instance.
4. ALB 与 CloudFront 优先使用 Alias，Apex 也能工作
时间范围：04:23–05:06
总结 / Summary
中文
ALB 可由 Alias Record 指向 AWS 提供的 Load Balancer DNS Name；Alias 同时适用于 Apex 与 Non-apex，因此在 AWS 内通常应优先使用。Non-apex（如 lb.example.com）也能用 CNAME。CloudFront 类似：Apex 必须用 Alias，Non-apex 可用 Alias 或 CNAME，再由 Distribution 把请求路由到各 Origin。
English
An ALB can be targeted by an alias record using its AWS-provided DNS name. Alias works for both apex and non-apex names and is generally preferred for AWS resources, while a non-apex name such as lb.example.com may also use CNAME. CloudFront is similar: use alias at the apex, and alias or CNAME below the apex, with the distribution routing to its origins.
Transcript
04:23 So next, some other common records you will see.
04:25 So for an ALB, for example,
04:26 we can point to the DNS name to the ALB.
04:28 In which case we can have two ways of doing it.
04:30 We can use an alias record
04:32 and I would recommend of using an alias.
04:34 And this would work for both apex and non apex
04:37 or if you're using a non apex type of record, for example,
04:40 lb.example.com, you could use a CNAME
04:42 but as a rule of thumb,
04:43 I would use alias whenever possible in AWS.
04:46 For CloudFront there is similar
04:48 so we can have a CloudFront distribution,
04:49 and again, we can create an alias for an apex
04:52 or an alias or CNAME for non apex.
04:54 And as we can see,
04:55 we just point one to CloudFronts and within CloudFronts,
04:58 then we can connect to multiple origins
05:00 and redirect to whatever we want.
05:01 But this is more of a CloudFront configuration
05:03 than a route 53 configuration.
5. API Gateway 可用 Alias；RDS Endpoint 必须用 CNAME
时间范围：05:06–05:29
总结 / Summary
中文
API Gateway 的 Regional 或 Edge-optimized Endpoint 可以作为 Route 53 Alias Target。RDS DB Instance 则不支持 Route 53 Alias，因此需要创建 CNAME，例如让 db.example.com 指向 RDS 提供的 Database Endpoint。考试中要区分哪些 AWS Resource 原生出现在 Alias Target 列表中。
English
Regional or edge-optimized API Gateway endpoints can be Route 53 alias targets. RDS DB instances do not support Route 53 alias records, so create a CNAME such as db.example.com pointing to the RDS-provided database endpoint. For the exam, distinguish AWS resources that appear natively in the alias-target list from those that require CNAME.
Transcript
05:06 For the API gateway, same thing.
05:07 So by using an alias record,
05:09 we're going to point the clean to the gateway region
05:12 or edge up to my DNS name.
05:14 And for an RDS database,
05:16 I'm not going to say alias
05:17 because this time alias does not work for RDS databases.
05:20 In this case, you must create a CNAME record
05:22 because well, alias doesn't work.
05:23 So we can create db.example.com
05:26 and have it as a CNAME into our RDS database.
6. S3 Static Website 使用 Alias，Bucket Name 必须等于 Domain Name
时间范围：05:29–06:04
总结 / Summary
中文
把域名指向 S3 Static Website Endpoint 时必须创建 Alias Record。另一个硬性条件是 S3 Bucket Name 与所服务的完整 Domain Name 完全一致；例如 example.com 的 Website Alias 必须落到名为 example.com 的 Bucket，否则 Host Header 与 S3 Website 映射无法正确匹配。
English
A domain targeting an S3 static website endpoint must use an alias record. The S3 bucket name must also exactly match the full domain being served. For example, a website alias for example.com must target a bucket named example.com so the host header and S3 website mapping match correctly.
Transcript
05:29 Now, for the S3 buckets,
05:32 we have S3 buckets used for static website hosting,
05:35 and then we want to point our DNS name
05:36 to the S3 website endpoints.
05:37 So in this case, we must create an alias record for it.
05:41 And the bucket name must
05:43 be the exact same as the domain name of your extra bucket.
05:47 So this is very, very, very important.
05:49 So if you have a domain name, for example,
05:51 example.com, then you have an alias to S3 websites.
05:55 Okay?
05:56 And the bucket of your buckets must be as well,
06:01 example.com, otherwise, things will not work.
7. PrivateLink Consumer 可用 Alias 指向 VPC Interface Endpoint
时间范围：06:04–06:30
总结 / Summary
中文
在 PrivateLink 架构中，Service Provider VPC 通过 NLB 发布 Endpoint Service，Service Consumer VPC 创建 Interface Endpoint。Route 53 可建立 Alias 指向这个 VPC Interface Endpoint，让私有域名直接解析到 Consumer VPC 内的 Endpoint ENI，从而通过 AWS 私网访问 Provider Service。
English
In a PrivateLink design, the provider VPC exposes an endpoint service through an NLB and the consumer VPC creates an interface endpoint. Route 53 can create an alias to that VPC interface endpoint, allowing a private name to resolve to endpoint ENIs in the consumer VPC and reach the provider service over the AWS private network.
Transcript
06:04 Okay, and finally,
06:06 we can have a domain name pointing
06:07 to a VPC interface endpoint, so backed by private link.
06:11 So this is a classic private link set up
06:13 in which we have a service provider,
06:14 private linked, linked to a VPC interface end points
06:17 for the service consumer VPC.
06:19 And what we can do is that,
06:20 we can have a route 53 alias pointing
06:23 to that VPC interface end points, okay?
06:26 Well, that's it for this lecture, I hope you liked it.
06:28 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Route 53 Record Type 取决于 Target：EC2 DNS Name 与 RDS Endpoint 用 CNAME；ALB、CloudFront、API Gateway、S3 Website、VPC Interface Endpoint 可用 Alias。Alias 支持 Zone Apex；S3 Website 还要求 Bucket Name 与 Domain 完全一致。EC2 Public DNS 会在 VPC 内返回 Private IP、外部返回 Public IP。
English
The Route 53 record type depends on the target: EC2 DNS names and RDS endpoints use CNAME, while ALB, CloudFront, API Gateway, S3 websites, and VPC interface endpoints support alias. Alias works at the zone apex, and an S3 website additionally requires the bucket name to match the domain exactly. EC2 public DNS returns a private address inside the VPC and a public address outside.
返回顶部 ↑