wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

The resolver they built, and the half of it they did not

Hybrid DNS went in last quarter and it demonstrably works: the data centre can resolve names in the VPC's private hosted zones, and that was the acceptance test everybody watched.

Now the application in the VPC needs to reach the licence server on the corporate domain, and it cannot resolve the name at all. Nothing has changed. Nothing was ever configured for this direction.

Place what resolves corporate names for instances inside the VPC. The direction that already works must keep working.
Components — tap one, then tap a slot on the diagram
!A batch job fails on a hostname the whole company can resolve from a laptop. The VPC's resolver returns NXDOMAIN, and the hybrid DNS project was signed off four months ago.A Resolver endpoint is DIRECTIONAL. The one that was built answers queries arriving from the network, and the queries failing here are leaving it.

Boundaries, outermost first: Platform VPC: Inbound endpoint (built last quarter), VPC Resolver (answers the zone), Batch job (asks a corp name; FAILED: NXDOMAIN), an empty slot for the for queries going the other way Corporate data centre: Corporate resolver (knows the host), Licence server (corporate domain) Connections: Corporate resolver calls Inbound endpoint — forwarded in (step 1) Inbound endpoint calls VPC Resolver (step 2) Batch job calls VPC Resolver — no answer (step 3) VPC Resolver calls for queries going the other way (step 4) for queries going the other way sends outbound traffic to Corporate resolver — only the names a rule names (step 5)

Inbound endpointbuilt last quarter
Corporate resolverknows the host
VPC Resolveranswers the zone
Licence servercorporate domain
Batch jobasks a corp nameNXDOMAIN