From f332d98b7eed6a449ec1ee728aec50aec6ffeca4 Mon Sep 17 00:00:00 2001 From: FoxUSA Date: Mon, 23 Jul 2018 20:32:57 -0500 Subject: [PATCH] Update README.md Added Route 53 Gotcha --- README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cf90562..3a6ec04 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ Table of Contents | [Lambda](#lambda) | [πŸ“—](#lambda-basics) | [πŸ“˜](#lambda-tips) | [πŸ“™](#lambda-gotchas-and-limitations) | | [API Gateway](#api-gateway) | [πŸ“—](#api-gateway-basics) | [πŸ“˜](#api-gateway-tips) | [πŸ“™](#api-gateway-gotchas-and-limitations) | | [Step Functions](#step-functions) | [πŸ“—](#step-function-basics) | [πŸ“˜](#step-function-tips) | [πŸ“™](#step-function-gotchas-and-limitations) | -| [Route 53](#route-53) | [πŸ“—](#route-53-basics) | [πŸ“˜](#route-53-tips) | | +| [Route 53](#route-53) | [πŸ“—](#route-53-basics) | [πŸ“˜](#route-53-tips) | [πŸ“™](#route-53-gotchas-and-limitations) | | [CloudFormation](#cloudformation) | [πŸ“—](#cloudformation-basics) | [πŸ“˜](#cloudformation-tips) | [πŸ“™](#cloudformation-gotchas-and-limitations) | | [VPCs, Network Security, and Security Groups](#vpcs-network-security-and-security-groups) | [πŸ“—](#vpc-basics) | [πŸ“˜](#vpc-and-network-security-tips) | [πŸ“™](#vpc-and-network-security-gotchas-and-limitations) | | [KMS](#kms) | [πŸ“—](#kms-basics) | [πŸ“˜](#kms-tips) | [πŸ“™](#kms-gotchas-and-limitations) | @@ -1548,6 +1548,10 @@ Route 53 - Understand that domain registration and DNS management (hosted zones) are two separate Route 53 services. When you buy/transfer a domain, Route 53 automatically assigns four name servers to it (e.g. ns-2.awsdns-00.com). Route 53 also offers to automatically create a hosted zone for DNS management, but you are not required do your DNS management in the same account or even in Route 53; you just need to create an NS record pointing to the servers assigned to your domain in Route 53. - One use case would be to put your domain registration (very mission critical) in a [bastion account](https://cloudonaut.io/your-single-aws-account-is-a-serious-risk/) while managing the hosted zones within another account which is accessible by your applications. +### Route 53 Gotchas and Limitations +- πŸ”ΈPrivate Hosted Zone will only respond to DNS queries that originate from within a VPC. As a result Route53 will not respond to request made via a VPN or Direct connect. To get around this you will need to implement [Hybrid Cloud DNS Solutions](https://d1.awsstatic.com/whitepapers/hybrid-cloud-dns-options-for-vpc.pdf) or use the Simple AD provided IP addresses to query the hosted zone. + + CloudFormation -------------- @@ -1558,7 +1562,7 @@ CloudFormation - πŸ’ΈCloudFormation itself has [no additional charge](https://aws.amazon.com/cloudformation/pricing/) itself; you pay for the underlying resources. ### CloudFormation Alternatives and Lock-In - + - Hashicorp’s [Terraform](https://www.terraform.io/intro/vs/cloudformation.html) is a third-party alternative that can support other cloud platforms/providers including [Azure](https://www.terraform.io/docs/providers/azure/) and [OpenStack](https://www.terraform.io/docs/providers/openstack/). - πŸ”ΈSome AWS features may not be available in Terraform (e.g. multi-AZ ElastiCache using Redis), and you may have to resort to embedded CloudFormation templates.