🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

📒 धडा 08 — VPC मधले DNS: campus ची phone book

📍 तुम्ही इथे आहात: 12 पैकी धडा 08 · मागचा: lesson-07-endpoints · पुढचा: lesson-09-peering

📦 या ब्रँचमध्ये काय आहे

धडे 01–07, आणि नावे: base + 2 वरचा VPC चा अंगभूत resolver, VPC चे दोन DNS switches, आणि एक private hosted zone school.internal जी फक्त तिच्याशी associate केलेल्या VPCs मध्येच उत्तर देते. vpc/demo.py मधले dns().

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

Campus वर कुणालाच खोल्यांचे नंबर आठवत नाहीत. लोक "परीक्षा कार्यालय" म्हणतात, 10.20.96.15 नाही. म्हणून प्रत्येक campus वर ठरलेल्या जागी एक phone book 📒 असते: नेहमी campus चा तिसरा नंबर (10.20.0.2). तिला नाव विचारा, ती तुम्हाला नंबर देते.

शाळा phone book मध्ये स्वतःची खाजगी पाने सुद्धा लिहिते: db.school.internal, app.school.internal. ही पाने फक्त याच campus च्या पुस्तकात असतात. भागीदार शाळेचे स्वतःचे पुस्तक आहे, आणि त्यात ही पाने नाहीत — जोपर्यंत शाळा जाणूनबुजून त्यांना एक प्रत देत नाही (एक association).

🗺️ आकृती

flowchart LR
    app["🖥️ app 10.20.48.25"]
    res["📒 resolver 10.20.0.2<br/>and 169.254.169.253"]
    phz["🔒 private zone school.internal<br/>associated: school VPC"]
    pub["🌍 public DNS"]
    partner["🤝 partner VPC"]
    app -->|"db.school.internal?"| res --> phz -->|"10.20.96.15"| app
    res -->|"other names"| pub
    partner -.->|"db.school.internal?"| x["no answer<br/>zone not associated"]

🗺️ रेखाटलेली आवृत्ती + एक lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l08

❓ काय

Amazon-provided DNS (Route 53 Resolver) — प्रत्येक VPC मध्ये एक असतो. तो VPC base address + 2 वर (10.20.0.0/16 साठी 10.20.0.2) आणि 169.254.169.253 वर उत्तर देतो. तो public नावे, AWS service नावे आणि तुमच्या private hosted zones resolve करतो.
enableDnsSupport — resolver VPC मध्ये चालतो (default ने चालू).
enableDnsHostnames — public IPs असलेल्या instances ना public DNS नावे मिळतात (default VPC मध्ये default ने चालू, तुम्ही तयार केलेल्या VPC मध्ये default ने बंद). Private hosted zones आणि interface-endpoint private DNS साठी दोन्ही switches चालू असावे लागतात.
Private hosted zone — एक Route 53 zone (जसे school.internal) जी फक्त तिच्याशी associate केलेल्या VPCs मध्येच उत्तर देते. इतर VPCs ना — अगदी peered असले तरी — तुम्ही zone त्यांच्याशी associate करेपर्यंत उत्तर मिळत नाही (वेगवेगळ्या accounts मध्येही, एका authorization पायरीसह).
Hybrid DNS — Route 53 Resolver inbound endpoints मुळे office ला VPC ची phone book विचारता येते; forwarding rules सह outbound endpoints मुळे VPC ला office ची phone book विचारता येते.
DHCP options set — instances ना कोणते DNS servers आणि domain name वापरायचे ते सांगते; default Amazon resolver कडे निर्देश करतो.

🤔 का

कारण पत्ते बदलतात आणि नावे बदलू नयेत. Fail over होणाऱ्या database ला नवा IP मिळतो; db.school.internal तरीही चालते. आणि कारण खाजगी नावे बाहेर फुटू नयेत: private hosted zone तुमचा अंतर्गत नकाशा तुम्ही निवडलेल्या VPCs च्या आतच ठेवते.

🔧 कसे (या repo मध्ये)

vpc/demo.py मधले dns() resolver ipaddress.ip_network(VPC)[2] असा काढते आणि एका छोट्या private zone मध्ये नावे शोधते. शेवटची ओळ partner VPC मधून विचारते, ज्याच्याशी zone associate केलेली नाही. खालचा snippet तीच zone स्पष्ट association list सह बांधतो, म्हणजे तुम्ही partner ला जोडू शकता.

🧪 करून पाहा

python3 vpc/demo.py dns
python3 - <<'EOF'
import ipaddress
for vpc in ("10.20.0.0/16", "10.30.0.0/16", "172.31.0.0/16", "192.168.4.0/22"):
    print(vpc.ljust(15), "resolver", ipaddress.ip_network(vpc)[2])
EOF
python3 - <<'EOF'
zone = {"name": "school.internal", "vpcs": {"school"}, "records": {"db.school.internal": "10.20.96.15"}}
def resolve(name, from_vpc):
    if from_vpc not in zone["vpcs"]: return "NXDOMAIN — zone not associated with " + from_vpc
    return zone["records"].get(name, "NXDOMAIN — no such record")
print(resolve("db.school.internal", "school"))
print(resolve("db.school.internal", "partner"))
zone["vpcs"].add("partner")                    # associate the zone with the partner VPC too
print(resolve("db.school.internal", "partner"))
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

dns हे छापते:

── every VPC has a resolver at base + 2 = 10.20.0.2 (and 169.254.169.253); enableDnsSupport + enableDnsHostnames on
   db.school.internal                         → 10.20.96.15
   app.school.internal                        → 10.20.48.25
   db.school.internal (from the partner VPC)  → no answer — private zone not associated with that VPC

पहिला snippet resolver 10.20.0.2, 10.30.0.2, 172.31.0.2 आणि 192.168.4.2 छापतो. दुसरा आधी 10.20.96.15, मग NXDOMAIN — zone not associated with partner, आणि partner associate झाल्यावर पुन्हा 10.20.96.15 छापतो.

🏁 तुम्ही आत्ताच काय सिद्ध केले

कोणत्याही VPC ची phone book तुम्ही त्याच्या CIDR वरून शोधू शकता, आणि तुम्हाला माहीत आहे की खाजगी नाव फक्त तिथेच उत्तर देते जिथे त्याची zone associate केलेली असते.

⚠️ नेहमीच्या चुका

नव्या VPC मध्ये enableDnsHostnames बंद — private hosted zone किंवा endpoint private DNS "चालत नाही"
peering मुळे private hosted zones share होतील अशी अपेक्षा — zone दुसऱ्या VPC शी associate करा
host firewall मध्ये 169.254.169.253 किंवा base + 2 block करणे
नावांऐवजी database IPs hard-code करणे
public zone सारख्याच नावाची private zone, आणि मग VPC च्या आत public records का गायब होतात याचे आश्चर्य

🏭 प्रत्यक्ष वापरात

Teams प्रत्येक environment साठी एक private zone वापरतात (prod.school.internal), ती गरज असलेल्या प्रत्येक VPC शी associate करतात, आणि office सोबत share होणाऱ्या नावांसाठी Resolver endpoints वापरतात.

खऱ्या account वर (AWS CLI आणि credentials लागतात; IDs उदाहरणादाखल आहेत):

aws ec2 modify-vpc-attribute --vpc-id vpc-0123456789abcdef0 --enable-dns-support '{"Value":true}'
aws ec2 modify-vpc-attribute --vpc-id vpc-0123456789abcdef0 --enable-dns-hostnames '{"Value":true}'
aws route53 create-hosted-zone --name school.internal --caller-reference school-2026-09-27 \
    --vpc VPCRegion=ap-south-1,VPCId=vpc-0123456789abcdef0
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z0123456789EXAMPLE \
    --vpc VPCRegion=ap-south-1,VPCId=vpc-0partner0000000a

⏭️ पुढे

भागीदार शाळेला आपल्या phone book पेक्षा जास्त काहीतरी हवे — तिला एक corridor हवा. VPC peering दोन campuses जोडते.

git checkout lesson-09-peering

📒 Lesson 08 — DNS inside the VPC: the campus phone book

📍 You are here: Lesson 08 of 12 · Previous: lesson-07-endpoints · Next: lesson-09-peering

📦 What's in this branch

Lessons 01–07, plus names: the VPC's built-in resolver at base + 2, the two VPC DNS switches, and a private hosted zone school.internal that answers only inside the VPCs it is associated with. dns() in vpc/demo.py.

🧒 Explain like I'm 5

Nobody on campus remembers room numbers. They say "the exam office", not 10.20.96.15. So every campus has a phone book 📒 at a fixed place: always the third number of the campus (10.20.0.2). Ask it a name, it gives you the number.

The school also writes its own private pages in the phone book: db.school.internal, app.school.internal. These pages are only in this campus's book. The partner school has its own book, and those pages are not in it — unless the school hands them a copy on purpose (an association).

🗺️ Diagram

flowchart LR
    app["🖥️ app 10.20.48.25"]
    res["📒 resolver 10.20.0.2<br/>and 169.254.169.253"]
    phz["🔒 private zone school.internal<br/>associated: school VPC"]
    pub["🌍 public DNS"]
    partner["🤝 partner VPC"]
    app -->|"db.school.internal?"| res --> phz -->|"10.20.96.15"| app
    res -->|"other names"| pub
    partner -.->|"db.school.internal?"| x["no answer<br/>zone not associated"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l08

❓ What

Amazon-provided DNS (Route 53 Resolver) — every VPC has one. It answers at the VPC base address + 2 (10.20.0.2 for 10.20.0.0/16) and at 169.254.169.253. It resolves public names, AWS service names, and your private hosted zones.
enableDnsSupport — the resolver works in the VPC (on by default).
enableDnsHostnames — instances with public IPs get public DNS names (on by default in the default VPC, off by default in a VPC you create). Private hosted zones and interface-endpoint private DNS need both switches on.
Private hosted zone — a Route 53 zone (like school.internal) that answers only in the VPCs associated with it. Other VPCs — even peered ones — get no answer until you associate the zone with them (across accounts too, with an authorization step).
Hybrid DNS — Route 53 Resolver inbound endpoints let the office ask the VPC's phone book; outbound endpoints with forwarding rules let the VPC ask the office's.
DHCP options set — tells instances which DNS servers and domain name to use; the default points at the Amazon resolver.

🤔 Why

Because addresses change and names should not. A database that fails over gets a new IP; db.school.internal still works. And because private names must not leak: a private hosted zone keeps your internal map inside the VPCs you choose.

🔧 How (in this repo)

dns() in vpc/demo.py computes the resolver as ipaddress.ip_network(VPC)[2] and looks names up in a small private zone. The last line asks from the partner VPC, which the zone is not associated with. The snippet below builds the same zone with an explicit association list, so you can add the partner.

🧪 Try it

python3 vpc/demo.py dns
python3 - <<'EOF'
import ipaddress
for vpc in ("10.20.0.0/16", "10.30.0.0/16", "172.31.0.0/16", "192.168.4.0/22"):
    print(vpc.ljust(15), "resolver", ipaddress.ip_network(vpc)[2])
EOF
python3 - <<'EOF'
zone = {"name": "school.internal", "vpcs": {"school"}, "records": {"db.school.internal": "10.20.96.15"}}
def resolve(name, from_vpc):
    if from_vpc not in zone["vpcs"]: return "NXDOMAIN — zone not associated with " + from_vpc
    return zone["records"].get(name, "NXDOMAIN — no such record")
print(resolve("db.school.internal", "school"))
print(resolve("db.school.internal", "partner"))
zone["vpcs"].add("partner")                    # associate the zone with the partner VPC too
print(resolve("db.school.internal", "partner"))
EOF

✅ Verify — what you should see

dns prints:

── every VPC has a resolver at base + 2 = 10.20.0.2 (and 169.254.169.253); enableDnsSupport + enableDnsHostnames on
   db.school.internal                         → 10.20.96.15
   app.school.internal                        → 10.20.48.25
   db.school.internal (from the partner VPC)  → no answer — private zone not associated with that VPC

The first snippet prints resolver 10.20.0.2, 10.30.0.2, 172.31.0.2 and 192.168.4.2. The second prints 10.20.96.15, then NXDOMAIN — zone not associated with partner, then 10.20.96.15 once the partner is associated.

🏁 What you just proved

You can find any VPC's phone book from its CIDR, and you know that a private name answers only where its zone is associated.

⚠️ Common mistakes

enableDnsHostnames off in a new VPC — the private hosted zone or endpoint private DNS "does not work"
expecting peering to share private hosted zones — associate the zone with the other VPC
blocking 169.254.169.253 or base + 2 in a host firewall
hard-coding database IPs instead of names
a private zone with the same name as a public one, then wondering why the public records vanish inside the VPC

🏭 In production

Teams use one private zone per environment (prod.school.internal), associate it with every VPC that needs it, and use Resolver endpoints for names shared with the office.

On a real account (needs the AWS CLI and credentials; IDs are examples):

aws ec2 modify-vpc-attribute --vpc-id vpc-0123456789abcdef0 --enable-dns-support '{"Value":true}'
aws ec2 modify-vpc-attribute --vpc-id vpc-0123456789abcdef0 --enable-dns-hostnames '{"Value":true}'
aws route53 create-hosted-zone --name school.internal --caller-reference school-2026-09-27 \
    --vpc VPCRegion=ap-south-1,VPCId=vpc-0123456789abcdef0
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z0123456789EXAMPLE \
    --vpc VPCRegion=ap-south-1,VPCId=vpc-0partner0000000a

⏭️ Next

The partner school needs more than our phone book — it needs a corridor. VPC peering joins two campuses.

git checkout lesson-09-peering

← Previousendpoints Next →peering

This page is the lesson's README from the lesson-08-dns branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.