Use private domain-name targets with Amazon VPC Lattice

This article explains how to use private domain-name targets with Amazon VPC Lattice, enabling cross-VPC and cross-account service access using private DNS names instead of public addresses.

• Set ResourceConfigDnsResolution to IN_VPC to resolve names through the resource gateway's VPC DNS instead of public resolvers
• Choose DNS sources: Route 53 private hosted zones for internal services or Resolver forwarding rules for hybrid on-premises environments
• Create resource gateways, resource configurations, and service networks in the producer account, then share via AWS RAM
• Consumers must enable private DNS on VPC associations and set dns-options to SPECIFIED_DOMAINS_ONLY for private names
• ResourceConfigDnsResolution is immutable; decide resolution type upfront to avoid replacing the resource gateway
• TCP protocol only; IPv6-only subnets and ARN-type configurations are incompatible with IN_VPC resolution

Private domain-name targets eliminate the need for public DNS records or pinned addresses, allowing services to move, scale, or failover transparently across accounts and VPCs.