AWS workspaces: Add DNS-resolution prerequisite for VPC endpoint private DNS

Service: workspaces · 2026-10-07 · Documentation medium

File: workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md · Type: network

Summary

Adds a prerequisite bullet stating that users connecting from outside the endpoint's VPC (on-premises or another VPC) must resolve the endpoint's private DNS name themselves, since the endpoint VPC's Route 53 Resolver is not usable externally.

Security assessment

This prerequisite concerns hybrid/off-VPC clients resolving the AWS PrivateLink endpoint's private DNS name so traffic continues to flow over the private interface endpoint rather than falling back to public endpoints. It is network-security-adjacent configuration guidance (private connectivity, avoiding public exposure) rather than a fix for a specific vulnerability.

Evidence

+  * Your users might connect from a network outside the VPC, such as an on-premises network or a different VPC. In that case, the outside network must also be able to resolve the endpoint's private DNS name. The Amazon Route 53 Resolver for the endpoint's VPC cannot be used from outside that VPC. For more information, see [Access AWS services through AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html).

Diff

diff --git a/workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md b/workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md
index 7d4aeca..e8945ba 100644
--- a//workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md
+++ b//workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md
@@ -44,0 +45,2 @@ Before you set up VPC endpoints for WorkSpaces, be aware of the following prereq
+  * Your users might connect from a network outside the VPC, such as an on-premises network or a different VPC. In that case, the outside network must also be able to resolve the endpoint's private DNS name. The Amazon Route 53 Resolver for the endpoint's VPC cannot be used from outside that VPC. For more information, see [Access AWS services through AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html).
+