Route 53 DNS

Start as usual, with the Session Manager endpoints:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$env:Path += ';C:\Program Files\Amazon\SessionManagerPlugin\bin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
.\Start-SsmEndpoints.ps1

1Launch dns01 with dig installed

Paste this whole block:

[IO.File]::WriteAllText('C:\aws-lab\dns-userdata.sh', "#!/bin/bash`ndnf install -y bind-utils`n")
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$i = aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --user-data file://dns-userdata.sh --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dns01},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=19}]' --query "Instances[0].InstanceId" --output text
$ip = aws ec2 describe-instances --instance-ids $i --query "Reservations[0].Instances[0].PrivateIpAddress" --output text
$ip

You should see something like this:

10.20.11.25

The private IP is known as soon as the instance is created, so you can build its DNS record while it boots.

2Create the private hosted zone

Paste this whole block:

$z = aws route53 create-hosted-zone --name saat.internal --caller-reference "lesson19-$(Get-Date -Format yyyyMMddHHmmss)" --vpc "VPCRegion=ap-south-1,VPCId=$($v.VpcId)" --hosted-zone-config Comment=lesson19,PrivateZone=true --query HostedZone.Id --output text
$zone = ($z -split '/')[-1]
aws route53 change-tags-for-resource --resource-type hostedzone --resource-id $zone --add-tags Key=course,Value=saatvedha-aws Key=lesson,Value=19
aws route53 get-hosted-zone --id $zone --query "[HostedZone.Name,HostedZone.Config.PrivateZone,VPCs[0].VPCId]" --output text

You should see something like this:

saat.internal.  True    vpc-0a1b2c3d4e5f67890

The caller reference is a unique string that stops the same request from creating two zones if you retry it. A date stamp works well.

3Add A, CNAME and TXT records

Paste this whole block:

@'
{
  "Comment": "lesson 19 records",
  "Changes": [
    { "Action": "CREATE", "ResourceRecordSet": { "Name": "app.saat.internal", "Type": "A", "TTL": 60, "ResourceRecords": [ { "Value": "APP_IP" } ] } },
    { "Action": "CREATE", "ResourceRecordSet": { "Name": "db.saat.internal", "Type": "CNAME", "TTL": 60, "ResourceRecords": [ { "Value": "app.saat.internal" } ] } },
    { "Action": "CREATE", "ResourceRecordSet": { "Name": "saat.internal", "Type": "TXT", "TTL": 300, "ResourceRecords": [ { "Value": "\"owner=platform-team\"" } ] } }
  ]
}
'@ -replace 'APP_IP', $ip | Set-Content records.json
$chg = aws route53 change-resource-record-sets --hosted-zone-id $zone --change-batch file://records.json --query ChangeInfo.Id --output text
aws route53 wait resource-record-sets-changed --id $chg
aws route53 list-resource-record-sets --hosted-zone-id $zone --query "ResourceRecordSets[].[Name,Type,TTL]" --output text

You should see this:

saat.internal.  NS      172800
saat.internal.  SOA     900
saat.internal.  TXT     300
app.saat.internal.      A       60
db.saat.internal.       CNAME   60

Route 53 created the NS and SOA records with the zone. The waiter returned once your change was INSYNC on every Route 53 server.

4Query from inside and outside the VPC

Paste this whole block:

do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online')
aws ssm start-session --target $i --document-name AWS-StartInteractiveCommand --parameters command="cloud-init status --wait"
aws ssm start-session --target $i --document-name AWS-StartInteractiveCommand --parameters command="dig app.saat.internal +noall +answer"
aws ssm start-session --target $i --document-name AWS-StartInteractiveCommand --parameters command="dig db.saat.internal +short"
aws ssm start-session --target $i --document-name AWS-StartInteractiveCommand --parameters command="dig saat.internal TXT +short"
Resolve-DnsName app.saat.internal

You should see something like this (session start and exit lines left out):

status: done
app.saat.internal.      60      IN      A       10.20.11.25
app.saat.internal.
10.20.11.25
"owner=platform-team"
Resolve-DnsName : app.saat.internal : DNS name does not exist

Read the dig answer left to right: name, TTL in seconds, class, type, value. The CNAME answer shows both steps, the alias and the address it leads to. Your laptop gets “does not exist” because it asks public DNS, which knows nothing about private zones.

✅ Checkpoint: saat.internal is a private zone linked to saat-vpc, dig on dns01 returns the A, CNAME and TXT answers, and your laptop can’t resolve app.saat.internal. Keep everything for the break lab.