AWS vpc: Document IN_VPC DNS resolution constraints for resource gateways
Summary
Replaces a prose sentence with a table of constraints that apply when a resource gateway's DNS resolution is set to IN_VPC, covering IPv6-only subnet support, ARN resource configurations, UDP-only DNS transport, maximum DNS payload size, recursive resolver requirements, and DHCP option set propagation delay.
Security assessment
The change documents DNS resolution behavior and limits (UDP-only, 8,400-byte payload cap, recursive resolver requirement) for VPC Lattice resource gateways. This is operational/configuration guidance with only tangential security relevance (DNS resolution failure modes), not a fix for a vulnerability or a security feature.
Evidence
+DNS queries use UDP only. TCP fallback isn't supported.
Diff
diff --git a/vpc/latest/privatelink/resource-gateway.md b/vpc/latest/privatelink/resource-gateway.md index 2b1a458..e723555 100644 --- a//vpc/latest/privatelink/resource-gateway.md +++ b//vpc/latest/privatelink/resource-gateway.md @@ -92 +92 @@ You can specify how a resource gateway performs DNS resolution for resource conf - * **IN_VPC** \- Domain names are resolved using the DNS server configured in the DHCP option set of the VPC which the resource gateway is in. You should use this if you are using a private DNS server or your domain-name targets are in a Route 53 private hosted zone. + * **IN_VPC** \- Domain names are resolved using the DNS server configured in the Dynamic Host Configuration Protocol (DHCP) option set of the VPC which the resource gateway is in. You should use this if you are using a private DNS server or your domain-name targets are in a Route 53 private hosted zone. @@ -97 +97,13 @@ You can specify how a resource gateway performs DNS resolution for resource conf -If DNS resolution is IN_VPC, you cannot attach resource configurations defined by ARN to the resource gateway. You cannot set DNS resolution to IN_VPC if the resource gateway uses IPv6-only subnets. DNS resolution has to be IN_VPC to attach CIDR resource configurations to the resource gateway. +The following table lists the constraints that apply when DNS resolution is set to IN_VPC. + +Constraint | Details +---|--- +IPv6 only subnet support | You can't attach an `IN_VPC` enabled resource gateway to an IPv6 only subnet. +ARN resource configurations | You can't attach resource configurations defined by ARN to the resource gateway. +DNS transport protocol | DNS queries use UDP only. TCP fallback isn't supported. +Maximum DNS payload size | VPC Lattice advertises a maximum DNS payload size of 8,400 bytes. Because TCP fallback isn't supported, DNS resolution fails for responses larger than this size. +Recursive DNS resolver | The DNS resolver must be recursive. If a response contains a CNAME record, the response must also contain the records that the CNAME resolves to. + +To attach a CIDR resource configuration to a resource gateway, it must have `IN_VPC` enabled. + +DHCP option set DNS server changes take 24 hours to propagate to a resource gateway that uses `IN_VPC` DNS resolution.