VPC A and B in the same account and Region have nonoverlapping IPv4 CIDRs and an active VPC peering connection. Both enableDnsSupport and enableDnsHostnames are enabled, and the target EC2 instances have public IPv4 DNS hostnames.
The instances must resolve those public IPv4 DNS hostnames to private IPv4 addresses in both directions and communicate over peering. Security groups and NACLs allow the required traffic, but peering DNS resolution options and routes to peer CIDRs are not configured.
Which TWO configurations are required?
Enable bidirectional peering DNS resolution and add peer-CIDR routes on both sides. Sharing a private hosted zone requires separate configuration.
Detailed explanation
The peer also needs a return route. A DNS response containing a private IP does not make one-sided routing sufficient for bidirectional communication.
The peer also needs a return route. A DNS response containing a private IP does not make one-sided routing sufficient for bidirectional communication.
Private IPv4 name resolution and the IP path are separate settings. Return routes are needed as well as outbound routes; enabling DNS resolution does not add routes automatically.
Private IPv4 name resolution and the IP path are separate settings. Return routes are needed as well as outbound routes; enabling DNS resolution does not add routes automatically.
The feature changes resolution of EC2 public IPv4 DNS hostnames. It does not automatically associate arbitrary private hosted zones; design separate VPC associations or another appropriate DNS architecture for those namespaces.
The feature changes resolution of EC2 public IPv4 DNS hostnames. It does not automatically associate arbitrary private hosted zones; design separate VPC associations or another appropriate DNS architecture for those namespaces.
This bidirectional requirement needs DNS resolution permission in both directions. Queries for EC2 public IPv4 DNS hostnames from the peer VPC return private IPv4 addresses. VPC DNS attributes alone do not enable peering DNS resolution.
This bidirectional requirement needs DNS resolution permission in both directions. Queries for EC2 public IPv4 DNS hostnames from the peer VPC return private IPv4 addresses. VPC DNS attributes alone do not enable peering DNS resolution.
The VPC DNS attributes are prerequisites but are already enabled. The peering connection also needs DNS resolution enabled; rechecking the attributes alone does not change the public hostname response.
The VPC DNS attributes are prerequisites but are already enabled. The peering connection also needs DNS resolution enabled; rechecking the attributes alone does not change the public hostname response.
Check official documentation
Compare the following points with the official documentation.
Query the EC2 public IPv4 DNS hostnames from both sides and verify private IPv4 answers and application communication over peering.
Official references
What to confirm
The public IPv4 DNS hostnames resolve to private IPv4 addresses from the peer, and application communication succeeds over the configured round-trip routes.
Key points
- VPC peering DNS
- Route table
- Private IP
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Reviewed against the linked AWS documentation on 2026-10-10.
Foundation review
The feature targets EC2 public IPv4 DNS hostnames
An active peering connection and enableDnsSupport and enableDnsHostnames in both VPCs are prerequisites. For this bidirectional scenario, enable allowDnsResolutionFromRemoteVpc on both requester and accepter sides. EC2 public IPv4 DNS hostnames resolve to private IPv4 addresses from the peer. This is not general DNS forwarding for arbitrary internal namespaces.
Separate name resolution from round-trip routing
Add peer-CIDR routes with a pcx target to the relevant subnet route tables on both sides. DNS settings do not add routes automatically. Successful resolution does not prove connectivity; check return routes, security groups, NACLs, and application listeners. Security groups and NACLs are already configured in this question.
Associate private hosted zones separately
To resolve arbitrary records from a Route 53 private hosted zone in another VPC, design the required VPC associations or an appropriate DNS architecture. Peering DNS alone does not automatically share zones, and VPC peering does not provide transitive connectivity.