# Guidance for Amazon VPC Lattice Automated DNS Configuration on AWS ## Overview This Guidance demonstrates an automated approach for creating the DNS resolution required when creating Amazon VPC Lattice services with custom domain names in multi-account environments. It simplifies the configuration process by automating the Amazon Route 53 DNS setup based on Amazon VPC Lattice service creation and removal actions, eliminating the operational effort of creating resources at scale. You can benefit from a simplified way to connect services across multiple AWS accounts, allowing applications to transparently access the required DNS resolution. ## How it works These technical details feature an architecture diagram to illustrate how to effectively use this solution. The architecture diagram shows the key components and their interactions, providing an overview of the architecture's structure and functionality step-by-step. [Download the architecture diagram](https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/solutions/approved/documents/architecture-diagrams/amazon-vpc-lattice-automated-dns-configuration-on-aws.pdf) ![Architecture diagram](/images/solutions/amazon-vpc-lattice-automated-dns-configuration-on-aws/images/amazon-vpc-lattice-automated-dns-configuration-on-aws-1.png) 1. **Step 1**: When a new spoke account creates a new Amazon VPC Lattice service, an Amazon EventBridge rule checks that a VPC Lattice service has been created with the proper tag. The EventBridge rule (default event bus) also verifies whether a VPC Lattice service has been deleted upon the removal of such tag. 1. **Step 2**: The event is forwarded to the 'Get VPC Lattice service information' AWS Step Functions state machine. Depending on the action (creation or deletion), the state machine publishes an event to the custom event bus. Additionally, for created resources with custom domain names, the state machine retrieves the domain name configuration details, including the domain name generated by VPC Lattice, the hosted zone managed by VPC Lattice, and the custom domain name. 1. **Step 3**: The 'vpclattice_information' custom event bus in the spoke account is configured with a target pointing to the 'cross_account' event bus in the networking account. 1. **Step 4**: Unsuccessfully processed events from delivery are stored in the Amazon Simple Queue Service (Amazon SQS) dead-letter-queue (DLQ) within the spoke account for monitoring. 1. **Step 5**: The 'cross_account' custom event bus in the networking account invokes the DNS configuration Step Functions state machine. This processes the notification sent from the spoke account. 1. **Step 6**: Unsuccessfully processed events are stored in the DLQ in the networking account for monitoring. 1. **Step 7**: The DNS configuration state machine creates or deletes the corresponding alias record in the private hosted zone. 1. **Step 8**: AWS Systems Manager and AWS Resource Access Manager (AWS RAM) are used for secure parameter storage and cross-account data sharing. ## Deploy with confidence Everything you need to launch this Guidance in your account is right here. - **We'll walk you through it**: Dive deep into the implementation guide for additional customization options and service configurations to tailor to your specific needs. [Open guide](https://aws-solutions-library-samples.github.io/networking/amazon-vpc-lattice-automated-dns-configuration-on-aws.html) - **Let's make it happen**: Ready to deploy? Review the sample code on GitHub for detailed deployment instructions to deploy as-is or customize to fit your needs. [Go to sample code](https://github.com/aws-solutions-library-samples/guidance-for-amazon-vpc-lattice-automated-dns-configuration-on-aws) ## Well-Architected Pillars The architecture diagram above is an example of a Solution created with Well-Architected best practices in mind. To be fully Well-Architected, you should follow as many Well-Architected best practices as possible. ### Operational Excellence EventBridge triggers an automated process when a new VPC Lattice service is created. This process invokes a Step Functions state machine to obtain DNS information for the VPC Lattice service and publishes an event to a custom EventBridge event bus. In the DNS-managing AWS account, another Step Functions state machine receives this event through a cross-account event bus and creates the corresponding DNS configuration by adding alias records. This automation eliminates manual DNS configuration for new or deleted VPC Lattice services, reducing operational overhead in multi-account, large-scale environments and enabling transparent DNS resolution for application services. [Read the Operational Excellence whitepaper](/wellarchitected/latest/operational-excellence-pillar/welcome.html) ### Security Amazon SQS policies restrict access to specified accounts, organizations, or resources. AWS Identity & Access Management (IAM) roles for Step Functions limit access to relevant resources like EventBridge, Route 53, or VPC Lattice. AWS RAM securely shares resources such as EventBridge event buses only within the same AWS Organization. These measures enforce the principle of least privilege, limiting access to VPC Lattice DNS resolution automation to only the necessary configuration resources and AWS accounts. [Read the Security whitepaper](/wellarchitected/latest/security-pillar/welcome.html) ### Reliability The use of managed services like EventBridge, Step Functions, and Amazon SQS minimizes failure risks for continuous event processing without downtime. Specifically, Amazon SQS DLQs in EventBridge targets enable monitoring and retrying of failed message processing. Whereas Step Functions state machines, running serverless, process these events and collect logs for comprehensive visibility. [Read the Reliability whitepaper](/wellarchitected/latest/reliability-pillar/welcome.html) ### Performance Efficiency This Guidance uses minimal latency for processing automation across accounts, enabling swift connectivity between a consumer and a newly created VPC Lattice service. In addition, EventBridge provides real-time event processing as a managed service. Moreover, Step Functions and Amazon SQS, both Regional managed serverless services, deliver optimal performance with low operational overhead. This combination of services provides rapid response times and efficient resource utilization in the VPC Lattice DNS resolution automation system, meeting the need for near immediate service availability. [Read the Performance Efficiency whitepaper](/wellarchitected/latest/performance-efficiency-pillar/welcome.html) ### Cost Optimization AWS manages the computing resources used in this architecture, following a serverless paradigm. EventBridge, Step Functions, and Amazon SQS operate on-demand, activating only when a new VPC Lattice service is created. This serverless approach ensures compute capacity is used briefly for specific actions, avoiding costs associated with long-running processes. By using these managed services, the VPC Lattice DNS resolution automation system optimizes resource utilization while maintaining high performance and reliability. [Read the Cost Optimization whitepaper](/wellarchitected/latest/cost-optimization-pillar/welcome.html) ### Sustainability On-demand computational services and real-time event processing minimize resource usage and environmental impact. For example, EventBridge, Step Functions, and Amazon SQS are fully managed AWS services that operate on an event-driven basis, providing high efficiency and low cost for short-duration tasks. This event-driven architecture in the VPC Lattice DNS resolution automation system contributes to a smaller environmental footprint compared to continuously running processes. [Read the Sustainability whitepaper](/wellarchitected/latest/sustainability-pillar/sustainability-pillar.html) [Read usage guidelines](/solutions/guidance-disclaimers/)