Building Private DNS with Amazon Route 53

While learning AWS networking, I wanted to understand DNS beyond simply mapping a domain name to an IP address. I built this lab to explore how Amazon Route 53 Private Hosted Zones work inside a VPC.

In this architecture, a bastion host needs to access an internal server using a private DNS name instead of directly using its private IP address.

The private hosted zone contains records such as:

and:

When the bastion host queries:

Route 53 resolves the CNAME first:

Then the A record resolves the hostname to:

The final flow looks like this:

One important concept I learned from this lab is that DNS resolution and network connectivity are separate things.

DNS answers:

while VPC networking determines:

Even if a hostname successfully resolves to 10.10.0.10, connectivity can still fail because of security groups, routing, or network ACLs.

This lab helped me better understand how private DNS can make internal AWS architectures easier to manage and avoid hard-coding private IP addresses.

I am also building and documenting more AWS projects on my personal website:

My goal is to keep learning through hands-on projects and share what I learn in a simple way that other cloud learners can reproduce and understand.