wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

The packets crossed, and the name did not

Two accounts, peered and routed, and the peering is not in question: an instance in the Platform account can reach the ledger's private address directly and gets a response on the first try.

What it cannot do is find that address. The ledger is published in a private hosted zone that lives in the Payments account, and every lookup from the Platform side comes back NXDOMAIN.

Place what makes that zone answer for the other account's VPC. The zone stays where it is.
Components — tap one, then tap a slot on the diagram
!A migrated service works when pointed at an IP and fails when pointed at the name it was written to use. The peering connection is active, routes are in place, and connectivity was proven with the address the failing lookup was supposed to return.A peering connection carries packets. A private hosted zone answers for the VPCs it is ASSOCIATED with, and peering does not associate anything.

Boundaries, outermost first: Platform account VPC: VPC Resolver (nothing to ask), Migrated service (asks by name; FAILED: NXDOMAIN), an empty slot for the so the zone answers here too Payments account VPC: Private hosted zone (ledger.corp), Ledger (reachable by IP) Connections: Migrated service calls VPC Resolver — ledger.corp? (step 1) so the zone answers here too controls Private hosted zone — authorize, then associate (step 2) Private hosted zone calls VPC Resolver — answers here now (step 3) Migrated service publishes to Ledger (step 4)

Private hosted zoneledger.corp
VPC Resolvernothing to ask
Ledgerreachable by IP
Migrated serviceasks by nameNXDOMAIN