AWS Route 53プライベートホストゾーンでVPC内DNSを設計する方法｜マルチVPC対応とResolver Endpointのオンプレミス連携まで

この記事のポイント

・VPC内でカスタムドメインを使うにはプライベートホストゾーンが必要
・enableDnsSupportとenableDnsHostnamesを両方ONにしないと解決されない
・マルチVPCや別アカウントのVPCにも追加の関連付けで対応できる
・オンプレミスとの双方向DNS解決はResolver Endpointで実現する

# VPCのDNS設定を確認する
$ aws ec2 describe-vpc-attribute --vpc-id vpc-0a1b2c3d4e5f67890     --attribute enableDnsSupport

{
    "VpcId": "vpc-0a1b2c3d4e5f67890",
    "EnableDnsSupport": {
        "Value": true
    }
}

$ aws ec2 describe-vpc-attribute --vpc-id vpc-0a1b2c3d4e5f67890     --attribute enableDnsHostnames

{
    "VpcId": "vpc-0a1b2c3d4e5f67890",
    "EnableDnsHostnames": {
        "Value": true
    }
}

# enableDnsSupportを有効にする
$ aws ec2 modify-vpc-attribute     --vpc-id vpc-0a1b2c3d4e5f67890     --enable-dns-support "{\"Value\":true}"

# enableDnsHostnamesを有効にする
$ aws ec2 modify-vpc-attribute     --vpc-id vpc-0a1b2c3d4e5f67890     --enable-dns-hostnames "{\"Value\":true}"

$ aws route53 create-hosted-zone \
    --name "app.internal" \
    --caller-reference "$(date +%s)" \
    --hosted-zone-config "Comment=Production private zone,PrivateZone=true" \
    --vpc "VPCRegion=ap-northeast-1,VPCId=vpc-0a1b2c3d4e5f67890"

{
    "Location": "https://route53.amazonaws.com/2013-04-01/hostedzone/Z1234ABCD5EFGH",
    "HostedZone": {
        "Id": "/hostedzone/Z1234ABCD5EFGH",
        "Name": "app.internal.",
        "Config": {
            "Comment": "Production private zone",
            "PrivateZone": true
        },
        "ResourceRecordSetCount": 2
    },
    "VPC": {
        "VPCRegion": "ap-northeast-1",
        "VPCId": "vpc-0a1b2c3d4e5f67890"
    }
}

# レコード登録用のJSONを作成
$ cat > /tmp/change-batch.json << 'EOF'
{
  "Changes": [
    {
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "db.app.internal",
        "Type": "A",
        "TTL": 300,
        "ResourceRecords": [
          { "Value": "10.0.1.50" }
        ]
      }
    }
  ]
}
EOF

# レコードを登録する
$ aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234ABCD5EFGH \
    --change-batch file:///tmp/change-batch.json

{
    "ChangeInfo": {
        "Id": "/change/C2ABCDEF3GHIJK",
        "Status": "PENDING",
        "SubmittedAt": "2026-08-24T03:15:42.123Z"
    }
}

# VPC内のEC2からdigで名前解決を確認
[ec2-user@ip-10-0-1-100 ~]$ dig db.app.internal +short

10.0.1.50

# ステージングVPCを追加で関連付ける
$ aws route53 associate-vpc-with-hosted-zone \
    --hosted-zone-id Z1234ABCD5EFGH \
    --vpc "VPCRegion=ap-northeast-1,VPCId=vpc-0b9c8d7e6f5a43210"

{
    "ChangeInfo": {
        "Id": "/change/C3LMNOP4QRSTUV",
        "Status": "PENDING",
        "SubmittedAt": "2026-08-24T03:22:11.456Z"
    }
}

# 関連付け済みVPCを確認する
$ aws route53 get-hosted-zone --id Z1234ABCD5EFGH | jq '.VPCs'

[
  {
    "VPCRegion": "ap-northeast-1",
    "VPCId": "vpc-0a1b2c3d4e5f67890"
  },
  {
    "VPCRegion": "ap-northeast-1",
    "VPCId": "vpc-0b9c8d7e6f5a43210"
  }
]

# ── ステップ1: ホストゾーン所有アカウント（Account A）で認証リクエストを作成 ──
$ aws route53 create-vpc-association-authorization \
    --hosted-zone-id Z1234ABCD5EFGH \
    --vpc "VPCRegion=ap-northeast-1,VPCId=vpc-0c1d2e3f4a5b67890"

{
    "HostedZoneId": "Z1234ABCD5EFGH",
    "VPC": {
        "VPCRegion": "ap-northeast-1",
        "VPCId": "vpc-0c1d2e3f4a5b67890"
    }
}

# ── ステップ2: VPC所有アカウント（Account B）で関連付けを実行 ──
$ aws route53 associate-vpc-with-hosted-zone \
    --hosted-zone-id Z1234ABCD5EFGH \
    --vpc "VPCRegion=ap-northeast-1,VPCId=vpc-0c1d2e3f4a5b67890"

{
    "ChangeInfo": {
        "Status": "INSYNC"
    }
}

# Inbound Resolver Endpointを作成する
$ aws route53resolver create-resolver-endpoint \
    --creator-request-id "inbound-ep-$(date +%s)" \
    --direction INBOUND \
    --security-group-ids sg-0a1b2c3d4e5f67890 \
    --ip-addresses SubnetId=subnet-0aaa111b2cc333d,Ip=10.0.1.10 \
                   SubnetId=subnet-0bbb222c3dd444e,Ip=10.0.2.10 \
    --name "prod-inbound-resolver"

{
    "ResolverEndpoint": {
        "Id": "rslvr-in-0a1b2c3d4e5f67890",
        "Name": "prod-inbound-resolver",
        "Direction": "INBOUND",
        "Status": "CREATING",
        "IpAddressCount": 2
    }
}

# 作成完了を確認（StatusがOPERATIONALになるまで待つ）
$ aws route53resolver get-resolver-endpoint \
    --resolver-endpoint-id rslvr-in-0a1b2c3d4e5f67890 \
    --query 'ResolverEndpoint.Status'

"OPERATIONAL"

# Outbound Resolver Endpointを作成する
$ aws route53resolver create-resolver-endpoint \
    --creator-request-id "outbound-ep-$(date +%s)" \
    --direction OUTBOUND \
    --security-group-ids sg-0a1b2c3d4e5f67890 \
    --ip-addresses SubnetId=subnet-0aaa111b2cc333d \
                   SubnetId=subnet-0bbb222c3dd444e \
    --name "prod-outbound-resolver"

{
    "ResolverEndpoint": {
        "Id": "rslvr-out-0b9c8d7e6f5a43210",
        "Name": "prod-outbound-resolver",
        "Direction": "OUTBOUND",
        "Status": "CREATING",
        "IpAddressCount": 2
    }
}

# Resolver Rule（条件付き転送ルール）を作成する
# オンプレミスのドメイン corp.example.com をDNS 192.168.1.53 へ転送
$ aws route53resolver create-resolver-rule \
    --creator-request-id "rule-corp-$(date +%s)" \
    --domain-name "corp.example.com" \
    --rule-type FORWARD \
    --resolver-endpoint-id rslvr-out-0b9c8d7e6f5a43210 \
    --target-ips Ip=192.168.1.53,Port=53 \
    --name "forward-to-onprem-corp"

{
    "ResolverRule": {
        "Id": "rslvr-rr-0c7d6e5f4a3b21098",
        "Name": "forward-to-onprem-corp",
        "DomainName": "corp.example.com.",
        "RuleType": "FORWARD",
        "TargetIps": [
            { "Ip": "192.168.1.53", "Port": 53 }
        ]
    }
}

# ルールをVPCに関連付ける（必須・忘れると機能しない）
$ aws route53resolver associate-resolver-rule \
    --resolver-rule-id rslvr-rr-0c7d6e5f4a3b21098 \
    --vpc-id vpc-0a1b2c3d4e5f67890

{
    "ResolverRuleAssociation": {
        "Id": "rslvr-rrassoc-0d3c2b1a0e9f87654",
        "ResolverRuleId": "rslvr-rr-0c7d6e5f4a3b21098",
        "VPCId": "vpc-0a1b2c3d4e5f67890",
        "Status": "COMPLETE"
    }
}

# ホストゾーンに関連付けられたVPCを確認する
$ aws route53 get-hosted-zone --id Z1234ABCD5EFGH \
    --query 'VPCs'

[
  {
    "VPCRegion": "ap-northeast-1",
    "VPCId": "vpc-0a1b2c3d4e5f67890"
  }
]

# VPCのCIDRが10.0.0.0/16であればDNSは10.0.0.2
[ec2-user@ip-10-0-1-100 ~]$ dig @10.0.0.2 db.app.internal +short

10.0.1.50