An internal domain name for a backend service refers to the URL of the backend service configured in API Gateway. If an internal URL is configured for a backend service, API Gateway provides the instance-level resolution feature.
Overview
For example, an internal URL used by a backend service is resolved by PrivateZone, in which case the resolution of the URL takes effect only in specified virtual private clouds (VPCs). If an API Gateway instance does not reside in any of the VPCs, it cannot resolve requests to the URL. In this case, you can configure internal domain name resolution in API Gateway to enable access from the API Gateway instance to the URL. For VPC integration instances, you can also configure weights for resolution records in API Gateway. The following figure shows the resolution process:
Step 1: Configure internal domain name resolution for a backend service
1. Create a resolution
Log on to the API Gateway console. In the left-side navigation pane, choose Instances and Clusters > Dedicated Instances.
Click the Internal DNS Resolution tab.
In the upper-right corner of the tab, click Add DNS Record. In the Add DNS Record dialog box, specify the Instance Type, Instance, and Internal Domain Name parameters. For VPC integration instances, you must also configure the Record Value parameter, which consists of the IP and Weight fields. For conventional dedicated instances, you must ensure that the internal domain name entered is the same as the Host value in the corresponding VPC authorization.
ImportantYou can configure a weight ranging from 0 to 100. If two IP addresses are assigned weights 1 and 2, traffic is forwarded to the IP addresses based on a ratio of 1:2. A weight of 0 indicates that no traffic is forwarded to the IP address.
2. Modify the resolution
You can modify an existing record. To do this, click Edit in the Actions column and modify the IP and Weight parameters of a record.
A record takes effect about 10 minutes after it is created or modified.
Step 2: Associate a dedicated instance
You can associate a resolution with an API Gateway instance in one of the two following methods:
Associate a resolution with an API Gateway instance when you create the resolution
When you create a resolution, select an instance from the Instance drop-down list. This enables the resolution to be automatically associated with the instance upon resolution creation.
Associate a resolution with an API Gateway instance in the instance list
Log on to the API Gateway console. In the left-side navigation pane, choose Instances and Clusters > Dedicated Instances.
Click the Instances tab. Next to Associated Internal Domain Name Resolution, click Associate. In the dialog box that appears, select a resolution from the Internal Domain Name drop-down list and click Confirm.
A resolution takes effect about 10 minutes after it is associated or modified.
Usage notes
After a resolution is associated with an instance, requests that are initiated from the instance to the internal domain name are automatically resolved to the configured resolution. Note that requests are resolved to the resolution even when the domain name has a public resolution.
VPC integration instance
If a backend service of the HTTP/HTTPS type has an internal URL, a related resolution record must be configured. Otherwise, API Gateway cannot resolve requests to the internal URL.
The record value must belong to an accessible CIDR block of the VPC in which the backend service resides.
If the resolution record has only one IP address and its weight is set to 0, the record does not take effect. The reason is that a weight of 0 indicates that no traffic is forwarded to the IP address.
Conventional dedicated instance
If you use a conventional dedicated instance, you must make sure that the internal domain name in a resolution is the same as the Host value of the VPC access authorization. This way, the Host value is used as the Server Name Indication (SNI) value during a Secure Sockets Layer/Transport Layer Security (SSL/TLS) handshake when the API Gateway instance sends an HTTPS request to the backend service in the VPC access authorization.
If a conventional dedicated instance uses a HTTPS-based VPC access authorization but no internal resolution is configured, no SNI is transmitted during an SSL/TLS handshake.
Limits
Only dedicated instances, including conventional dedicated instances and VPC integration instances, support internal domain name resolution for backend services.
You can create up to 100 resolutions in a single region.
You can associate a resolution with multiple dedicated instances of the same type.
You cannot associate a resolution with a dedicated instance cluster.
For VPC integration instances:
Only A records are supported. In A records, domain names are pointed to IPv4 addresses.
You can configure up to 20 A records for each domain name.
For conventional dedicated instances:
Only VPC access authorizations are supported.
You cannot add further records within a resolution. After you configure a resolution, traffic is forwarded to the mapped IP address of the corresponding VPC access authorization by default.