Question

A company has two VPCs, VPC-A and VPC-B, connected via a VPC peering connection with non-overlapping CIDR blocks and correct route table entries. Applications in VPC-A can reach EC2 instances in VPC-B using private IP addresses, but they fail when using the private DNS hostnames of the instances in VPC-B (the hostnames resolve to public IP addresses instead of private IPs). What should a CloudOps engineer do to resolve this issue?

Accepted Answer

Enable DNS resolution and DNS hostnames on both VPCs, then enable DNS resolution support on the VPC peering connection for both sides.

Answer

Add inbound security group rules in VPC-B to allow DNS traffic on TCP/UDP port 53 from VPC-A.

Answer

Create a Route 53 Resolver inbound endpoint in VPC-B and point VPC-A's DNS queries to it.

Answer

Modify the NACLs in both VPCs to allow UDP port 53 traffic in both directions.