An internal domain name is the address of a backend service that you configure in API Gateway. If a backend service uses an internal domain name, API Gateway provides instance-level DNS resolution for it.
Overview
For example, if the internal domain name of your backend service is resolved by using PrivateZone, the resolution takes effect only within the specified VPC. Because API Gateway does not reside in your VPC, it cannot resolve the internal domain name. To enable access to the internal domain name, configure internal DNS resolution in API Gateway. For a VPC integration instance, you can also configure a weight for each DNS record to distribute traffic. The following figure shows the process.
Step 1: Configure internal DNS resolution
1. Create an internal DNS record
-
Log on to the API Gateway console. In the navigation pane on the left, click Instances and Clusters and select Dedicated Instances.
-
Click the Internal DNS Resolution tab to manage internal DNS records.
-
In the upper-right corner of the page, click Add DNS Record. Specify the Instance Type and the target Instance, and enter the Internal Domain Name. For a VPC integration instance, you must also configure the Record Value and Weight. For a conventional dedicated instance, ensure the internal domain name matches the Host value in the vpc access authorization.
ImportantThe weight can be set to a value from 0 to 100. For example, if two IP addresses have weights of 1 and 2, traffic is distributed between them at a 1:2 ratio. If you set the weight to 0, no traffic is routed to that IP address.
In the dialog box, the Record Type defaults to A (maps a domain name to an IPv4 address). After you add or update a DNS record, the changes take effect in approximately 10 minutes.
2. Modify an internal DNS record
Click Edit in the Actions column to modify an existing record's Record Value and Weight.
After you add or modify an internal DNS record, the changes take effect in approximately 10 minutes.
Step 2: Associate a dedicated instance
You can associate an internal DNS record with a dedicated instance in two ways.
Associate during creation
When you create an internal DNS record, select the target instance from the Instance drop-down list. The record is then automatically associated with the selected dedicated instance.
Associate from the instance list
-
Log on to the API Gateway console. In the navigation pane on the left, click Instances and Clusters and select Dedicated Instances.
-
Click the Instances tab. In the Associated Internal Domain Name Resolutions section of the instance details, click Associate. In the dialog box, select the internal DNS record to associate.
After you associate a dedicated instance with an internal DNS record or update the record's value or weight, the changes take effect in approximately 10 minutes.
Usage notes
After an internal DNS record is associated with a dedicated instance, any request from that instance to the specified internal domain name resolves to the IP address configured in the record. This overrides any public DNS resolution for the domain name.
VPC integration instances
-
You must configure an internal DNS record for HTTP-based backend services that use an internal domain name. Otherwise, API Gateway cannot resolve the domain name.
-
The record value must be an IP address within an accessible CIDR block of the backend service's VPC.
-
An internal DNS record with a single IP address and a weight of 0 is ineffective because no traffic is forwarded to the IP address.
Conventional dedicated instances
When using a conventional dedicated instance, you must ensure that the internal domain name in the internal DNS record matches the Host value configured in the vpc access authorization. When API Gateway sends an HTTPS request to the service defined in the vpc access authorization, it sets the Server Name Indication (SNI) in the TLS handshake to the configured Host value.
If a conventional dedicated instance uses a vpc access authorization over HTTPS but no internal DNS record is configured, the SNI is not sent during the TLS handshake.
Limitations
-
This feature is available only for dedicated instances.
-
You can create up to 100 internal DNS records in each region.
-
An internal DNS record can be associated with multiple dedicated instances of the same type.
-
Internal DNS records cannot be associated with a dedicated instance cluster.
-
For a VPC integration instance:
-
Only A records, which map a domain name to an IPv4 address, are supported.
-
You can configure a maximum of 20 A records for an internal domain name.
-
-
For a conventional dedicated instance:
-
Only internal DNS records of the vpc access authorization type are supported.
-
You cannot add a record value. Traffic is routed to the IP address mapped by the VPC access authorization by default.
-