Browse the Repo

file-type-icon.circleci
file-type-iconexamples
file-type-iconmodules
file-type-icon_docs
file-type-iconnetwork-acl-inbound
file-type-iconnetwork-acl-outbound
file-type-iconvpc-app-network-acls
file-type-iconvpc-app
file-type-iconvpc-dns-forwarder-rules
file-type-iconvpc-dns-forwarder
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconvpc-flow-logs
file-type-iconvpc-mgmt-network-acls
file-type-iconvpc-mgmt
file-type-iconvpc-peering-external
file-type-iconvpc-peering
file-type-icontest
file-type-icon.gitignore
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.md

Browse the Repo

file-type-icon.circleci
file-type-iconexamples
file-type-iconmodules
file-type-icon_docs
file-type-iconnetwork-acl-inbound
file-type-iconnetwork-acl-outbound
file-type-iconvpc-app-network-acls
file-type-iconvpc-app
file-type-iconvpc-dns-forwarder-rules
file-type-iconvpc-dns-forwarder
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconvpc-flow-logs
file-type-iconvpc-mgmt-network-acls
file-type-iconvpc-mgmt
file-type-iconvpc-peering-external
file-type-iconvpc-peering
file-type-icontest
file-type-icon.gitignore
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.md
Virtual Private Cloud (VPC)

Virtual Private Cloud (VPC)

Create a Virtual Private Cloud (VPC). Includes multiple subnet tiers, NACLs, NAT gateways, Internet Gateways, and VPC peering.

Preview the Code

mobile file icon

README.md

down

VPC DNS Forwarder Terraform Module

This Terraform Module creates Route 53 Resolvers between VPCs so that DNS queries for specific domains in a VPC can be forwarded to another VPC over a peered network. This is useful when you would like to resolve Route 53 private hosted zones, which are typically not available over a peered network.

For example, EKS supports private API endpoints, which restricts access to the Kubernetes API to be within the VPC. However, the hostname for the internal endpoint is only resolvable from within the housing VPC because they are defined by a private hosted zone under the hood. This breaks our model of having a management VPC that acts as the entrypoint into the network. EKS clusters will typically be launched into the application VPC, which means the private endpoints are only addressable in the application VPC. However, operators need access to the endpoint to manage the cluster, but they only have access to VPN into the management VPC, which has a peering connection to the application VPC. To allow operators to properly resolve the hostname, they will need to be able to resolve it from within the management VPC. This can be done by creating a Route 53 Resolver that forwards DNS queries for the EKS endpoint originating in the management VPC to the application VPC's DNS resolver.

NOTE: In order for Route 53 Resolvers to work, the peering connection must allow remote VPC DNS resolution on both accepter and requester side of the connection peering.

How do you use this module?

Check out the vpc-peering example that shows how to use this module to forward DNS queries from a management VPC to an app VPC.

What is a Route 53 Resolver?

A Route 53 Resolver is a DNS server that answers DNS queries for VPC domain names that are internal to the VPC, such as VPC endpoints and private hosted zones. Normally such DNS queries are limited to those originating from the housing VPC, and therefore are not typically resolved for peering VPCs. Route 53 Resolvers allow you to link the DNS resolvers between multiple VPCs by forwarding specific domain DNS requests to other VPCs' DNS resolvers so that you can resolve private endpoints internal to the target VPC.

How do you specify the hostnames that use the forwarder?

By default, no DNS query will be routed through the Route 53 Resolvers created by this module. You need to create forwarding rules that specify which specific domains should be resolved through the Route 53 Resolvers created by this module. You can use the vpc-dns-forwarder-rules module to construct the forwarding rules.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?