Thursday, June 30, 2011

A strategy for handling DNS in EC2 with Route 53

In my previous post I showed how to use the boto library to manage Route 53 DNS zones. Here I will show a strategy for handling DNS within an EC2 infrastructure using Route 53.

Let's assume you have a registered domain name called You want all your EC2 instances to use that domain name to communicate with each other. Assume you launch a database instance that you want to refer to as What you do is you add a CNAME record in the DNS zone for and point it to the external AWS name assigned to that instance. For example:
# route53 add_record ZONEID CNAME 3600

The advantage of this method is that DNS queries for from within EC2 will eventually resolve the CNAME to the internal IP address of the instance, while DNS queries from outside EC2 will resolve it to the external IP address -- which is in general exactly what you want.

There's one more caveat: if you need the default DNS and search domain in /etc/resolv.conf to be, you need to configure the DHCP client to use that domain, by adding this line to /etc/dhcp3/dhclient.conf:

supersede domain-name " ec2.internal compute-1.internal" ;

Then edit/overwrite /etc/resolv.conf and specify:

search ec2.internal compute-1.internal

The line in dhclient.conf will ensure that your custom resolv.conf file will be preserved across reboots -- which is not usually the case in EC2 with the default DHCP behavior (thanks to Gerald Chao for pointing out this solution to me).

Of course, you should have all this in the Chef or Puppet recipes you use when you build out a new instance.

I've been applying this strategy for a while and it works out really well, and it also allows me to not run and take care of my own BIND servers in EC2.


Anonymous said...

Thank you. thank you. thank you. for a great solution to this.

Anonymous said...

Thanks for pointing me in the right direction. I think the dhclient.conf has to read something along these lines though:

supersede domain-name "";
supersede domain-search "", "ec2.internal", "compute-1.internal"; said...


Thanks for the information regarding using Route53. I've explored this a produced a solution using bash and python'boto' which I have written about at

Many thanks


Modifying EC2 security groups via AWS Lambda functions

One task that comes up again and again is adding, removing or updating source CIDR blocks in various security groups in an EC2 infrastructur...