wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

The DNS fix that was applied, confirmed, and did nothing for three hours

A data centre was decommissioned in March. Its resolver at 10.10.0.53 went with it, and the VPC's DHCP option set still names that address as its only domain name server.

Nothing in the VPC can resolve anything — not the corporate domain, not a private hosted zone, not S3. The cause is found in eleven minutes. What happens next is the question.

Both plans end with the VPC pointed at a working resolver. Choose the one where the incident actually ends when the change is made.
!Every instance in the VPC is failing DNS. An engineer associates a corrected DHCP option set, the console shows the new set attached, and the pages keep coming for another three hours.A DHCP option set cannot be edited, and associating a new one is not the same as the instances using it.
Design AAssociate the corrected set and stand down

Boundaries, outermost first: Platform VPC: Old option set (10.10.0.53), New option set (AWS DNS), App fleet (old lease), VPC Resolver (the .2) Connections: Old option set controls New option set — replaced, not edited New option set controls App fleet — associated with the VPC App fleet must NOT reach VPC Resolver — still not asking it

Old option set10.10.0.53
New option setAWS DNS
App fleetold lease
VPC Resolverthe .2
Design BAssociate it, then renew the leases

Boundaries, outermost first: Platform VPC: Old option set (10.10.0.53), New option set (AWS DNS), App fleet (renewed), VPC Resolver (the .2) Connections: Old option set controls New option set — replaced, not edited New option set controls App fleet — associated with the VPC App fleet calls VPC Resolver — asking it now

Old option set10.10.0.53
New option setAWS DNS
App fleetrenewed
VPC Resolverthe .2
Two designs, one brief. Read both, then choose the one that meets it.