DNS Resolution Path
Resolution path
Section titled “Resolution path”Key properties
Section titled “Key properties”- Resolution consistency — every associated VPC resolves
api.platform.demo.localto10.0.1.10regardless of same/cross-account or same/cross-region - Association is the prerequisite — VPC association enables DNS answers; it does not grant network connectivity to record IP targets
- Single authoritative zone — all records live in the Network_Account PHZ; workload accounts never create local PHZ copies
- Propagation delay — after a new association, allow 1–2 minutes before expecting in-VPC
digto answer
Verification model
Section titled “Verification model”Seven Test_EC2 instances (one per VPC) run dig +short api.platform.demo.local via SSM Session Manager. See Verification for the full test matrix.
ap-southeast-6 caveat
Section titled “ap-southeast-6 caveat”Route 53 resolution works independently of SSM. For *-apse6 stacks:
- Step A —
aws route53 list-hosted-zones-by-vpcproves association without shell access - Step B — in-VPC
digwhen SSM is available
DNS vs network reachability
Section titled “DNS vs network reachability”Demo A record targets (10.0.1.10, 10.0.1.20) are fictional private IPs in the network primary CIDR. Successful dig proves DNS resolution — not that traffic can route to those addresses across VPC boundaries.