Instances in a private subnet must call Secrets Manager.
Keep the standard AWS service hostname while resolving it to private endpoint addresses.
Which configuration is most appropriate?
Enable Private DNS on an Interface VPC Endpoint for Secrets Manager.
Detailed explanation
The standard service hostname resolves to the endpoint network interfaces' private addresses.
The standard service hostname resolves to the endpoint network interfaces' private addresses.
Public DNS overrides can expose or misroute a name that should resolve privately.
Public DNS overrides can expose or misroute a name that should resolve privately.
This does not provide private endpoint access or avoid NAT processing for the service.
This does not provide private endpoint access or avoid NAT processing for the service.
S3 lifecycle management is unrelated to endpoint DNS.
S3 lifecycle management is unrelated to endpoint DNS.
Check official documentation
Compare the following points with the official documentation.
AWS PrivateLink interface endpoint private DNS namesの公式説明を確認する。
What to confirm
Gateway EndpointとInterface EndpointのDNS動作を区別できる。
Key points
- Interface VPC Endpoint
- Private DNS
- Endpoint ENI
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Private access
Private DNS keeps application code unchanged while sending service calls through the VPC endpoint.
Endpoint types
Interface endpoints use ENIs and PrivateLink; gateway endpoints have different routing behavior.