[ec2] (design): Private DNS support for VPC endpoint services

[flemjame-at-amazon]

https://aws.amazon.com/premiumsupport/knowledge-center/vpc-private-dns-name-endpoint-service/
https://docs.aws.amazon.com/vpc/latest/userguide/verify-domains.html

❓ General Issue

AWS added the ability to specify a custom DNS name for an endpoint service earlier this year. It makes it so your clients don't have to create aliases for an InterfaceVpcEndpoint when they connect to your service. This reduces undifferentiated lifting done by clients. I'd like to add support for this to CDK.

The Question

The steps for setting it up involve creating Route53 records in a public hosted zone. I had intended it to be used like so:

new VpcEndpointService(this, 'EndpointService', {
  vpcEndpointServiceLoadBalancers: [networkLoadBalancer1, networkLoadBalancer2],
  acceptanceRequired: true,
  whitelistedPrincipals: [new ArnPrincipal('arn:aws:iam::123456789012:root')],
  privateDns: {
    privateDnsName: "my-service.mydomain.com",
    hostedZone: myHostedZone
  }
});

However this isn't possible -- the route53 module depends on the ec2 module, so I cannot add this feature to the VpcEndpointService construct without creating a circular dependency.

How can I get around this dependency? Would you recommend a different approach?

Environment

• CDK CLI Version: 1.64.1
• Module Version: 1.64.1
• Node.js Version: all
• OS: all
• Language (Version): all

[rix0rrr]

route53 depends on ec2 for the IVpc type.

The only thing I can really think of to work around this is to use Inversion of Control, so that we can implement it in route53:

// aws-ec2 module
interface VpcEndpointProps {
  privateDns: IPrivateDnsProvider;
}

// aws-route53 module
class PrivateDns implements ec2.IPrivateDnsProvider {
  public bind(...) {
  }
}

In fact, I think that's nicer as it looks like what you're supposed to do is create a route53 record to refer to the VPC endpoint anyway.

Or, even simpler is just to keep everything in route53:

// aws-route53
new VpcEndpointDomainName(this, 'Alias', {
  hostedZone: hostedZone,
  domainName: 'my-domain.com',
  endpoint: new VpcEndpointService(...),
});

[flemjame-at-amazon]

@rix0rrr do you think this would belong in the route53 module, or route53-patterns? Or something else?

[rix0rrr]

Feels like something that should be in route53.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[flemjame-at-amazon]

Will move to route53

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.