I'm encountering a challenge while deploying my ECS with EFS. My VPC is set up with a custom DNS configuration using DHCP options that point to a DNS server within the VPC and some on-premises DNS servers. Due to this setup, the AWS DNS isn't being utilized. However, when I attempt to deploy EFS in my ECS cluster, it fails because the EFS name isn't resolving with my current DNS setup. I've noticed that when I try accessing the container shell in ECS and set the DNS to a different IP within the range, it successfully resolves the EFS name. I've attempted to add this IP to the DHCP Options, but it hasn't resolved the issue. How can I configure my custom DNS server to properly forward DNS queries to the AWS DNS? Any suggestions would be greatly appreciated!
3 Answers
I faced a similar situation where my EFS was hosted in a separate account from my ECS. The key is ensuring that VPC peering or a transit gateway is set up correctly, and that your security groups are in order. You can utilize the ECS host entry feature to manually add the FQDN for EFS, as it resolves fine from anywhere unless you're only using the short name.
You might want to check out using Route 53 Resolver instead of sticking with custom DNS options on your VPC. ECS typically uses the .2 resolver for all DNS tasks, including resolving EFS names. With Route 53 Resolver, you can set it up to conditionally forward queries to your on-prem DNS. This should help with your current setup!
A straightforward solution is to adjust your DNS server to forward to the AWS DNS (.2). It's simpler and can get you moving forward quickly. But if you prefer a more robust solution, ensure everything points to AWS DNS. If you’re hosting zones on your DNS server, you can create private hosted zones in Route 53 and establish forwarding rules to other DNS servers as needed.
Absolutely! Route 53 Resolver is indeed a solid choice. It not only forwards queries to on-prem servers but can also redirect to custom DNS servers in AWS. Just make sure you set up a Route 53 Outbound Endpoint, and configure your security groups and firewall rules to allow the queries to reach your custom DNS server. Don’t forget to create a Route 53 Resolver Rule and link it to your VPC.