Confirm connectivity

Zone transfer needs a private path from the cloud sync Lambda to BIND. In this lab that path is Site-to-Site VPN — confirm at least one tunnel is UP before editing BIND or invoking sync.

aws --profile bind-demo-workload ec2 describe-vpn-connections \
  --vpn-connection-ids "$(terraform -chdir=infra/terraform/workload output -raw vpn_connection_id)" \
  --query 'VpnConnections[0].VgwTelemetry[].{OutsideIp:OutsideIpAddress,Status:Status}' \
  --output table

Pass: at least one tunnel UP (the second may stay DOWN in this demo).

Example shape:

-----------------------------------------------
|          DescribeVpnConnections             |
+------------------+-----------------+--------+
|     OutsideIp    |     Status      |        |
+------------------+-----------------+--------+
|  203.0.113.10    |  UP             |        |
|  203.0.113.20    |  DOWN           |        |
+------------------+-----------------+--------+

If both are DOWN, sync cannot AXFR from BIND — see Troubleshooting.

Next: Edit BIND.