I've read through all the AWS docs I can find and GoogleFoo has not resulted in anything.
My case here is we have one domain example.com and up to now we have used it only for Public records. There is one Hosted Zone set to Public. I want to now create a subdomain for private records to use inside of our VPC group for our application (e.g. to point at an ElastiCache instance).
I attempted to create private.example.com as a Private Hosted Zone pointing at our VPC and then created cache.private.example.com as a record under it but it will not resolve.
I am curious if I can configure a subdomain of our main domain somehow?
example.com - Public
** app.example.com
private.example.com - Private
** cache.private.example.com - VPC
OR
Can also create a Private Hosted Zone with the same top level domain example.com? I am nervous to try that because I do not want to affect the application.
example.com - Public
** app.example.com
example.com - Private
** cache.example.com - VPC
You can create more than one hosted zone that has the same name and add different records to each hosted zone. Route 53 assigns four name servers to every hosted zone, and the name servers are different for each of them.
There are two types of hosted zones: Public hosted zones contain records that specify how you want to route traffic on the internet. For more information, see Working with public hosted zones. Private hosted zones contain records that specify how you want to route traffic in an Amazon VPC.
For Googlers trying to "subsetting" a public host zone, or to make a private host zone "fallback" or "extend" to public. Read on.
Firstly, R53 is authoritative, means you have to provide exact resolution, so the common way of using different BIND views will not work. Also when host zone names overlap, the private one prevails.
Secondly, R53 will determine which host zone to use based on "specificity". So when user asks for www.example.com
, then a host zone named www.example.com
prevails another named example.com
. This is something we can make use of.
Follow the procedure:
example.com
), or just use any other public DNS record and skip this stepwww.example.com
)In this way, if your machine asks for www.example.com
, and a private host zone matches, it will return local addresses, otherwise, it will fallback to use the public host zone.
The pitfall for this solution is that R53 charges you by number of host zones, so you will have to pay a bit more. Also this is a bit hacky. Otherwise it eliminates the complexity of creating and managing your own BIND server, syncing public records, etc.
You will need to have a different domain for the private zone. Something like "example.internal" Then you could have "cache.example.internal"
cache.private.example.com will not resolve in your current setup, because it will be looking to example.com to resolve that dns. Also note it will only resolve inside the VPC.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With