Networking and Content Delivery
Route 53 DNS, Resolver, Routing Policies, and Global Delivery
CoreConfigure private and hybrid DNS, choose routing behavior from traffic requirements, collect the right query evidence, and distinguish CloudFront from Global Accelerator.
Aligned to AWS Certified CloudOps Engineer - Associate (SOA-C03) Version 1.1, verified August 24, 2026.
Why this matters
DNS records, recursive forwarding, health evaluation, query logs, caching, TLS, and network acceleration are neighboring but independent layers in global delivery.
Must Know
- Private hosted zones provide authoritative private records to associated VPCs; a public hosted zone remains public even if a record contains a private address.
- Route 53 Resolver inbound endpoints accept DNS queries from connected networks; outbound endpoints and forwarding rules send selected VPC queries to external resolvers. Network paths and security rules still apply.
- Choose simple, weighted, latency, failover, geolocation, geoproximity, or multivalue behavior from the stated traffic rule and configure health evaluation and TTL accordingly.
- Route 53 Resolver query logging records queries made through VPC resolvers at its configured scope; public DNS query logging records queries Route 53 receives for a public hosted zone. They are separate log types.
- CloudFront caches and distributes HTTP content with origins, behaviors, certificates, cache/origin policies, logs, and origin failover.
- Global Accelerator uses anycast static IP addresses and the AWS global network for supported regional endpoints, including non-cacheable and non-HTTP workloads; it is not a cache.
Compare and Distinguish
- A hosted zone stores authoritative records; Resolver endpoints and rules forward recursive queries across networks.
- Weighted routing splits configured proportions; latency routing selects by measured AWS-region latency; failover uses primary/secondary health; geolocation uses client location.
- CloudFront is content delivery and HTTP caching; Global Accelerator accelerates supported endpoint traffic without caching.
- DNS query logs show name-resolution activity; CloudFront access logs show viewer requests to a distribution.
Scenario examples
- Scenario: On-premises clients must resolve a VPC private zone and VPC clients must resolve an on-premises suffix. Use inbound and outbound Resolver endpoints, a forwarding rule, associations, and network access.
- Scenario: A team needs controlled canary traffic between two healthy endpoints. Use weighted records rather than calling the split latency routing.
- Scenario: A global TCP application cannot cache responses. Use Global Accelerator with healthy regional endpoints instead of CloudFront.
Exam traps
- Do not publish internal names in a public zone merely because the values are private IPs.
- Do not expect Resolver endpoints to create authoritative records.
- Do not treat a shorter TTL as a routing policy.
- Do not call Global Accelerator a CDN cache.
Key takeaways
- Separate authoritative zones from recursive forwarding.
- Translate the traffic rule into the routing policy.
- Choose the query-log type from who answered the query.
- Select CloudFront for cache/content behavior and Global Accelerator for supported endpoint acceleration.
How it works
- Trace who should answer the query and each forwarding rule and network path used to reach that authority.
- Validate record type, routing values, health evaluation, TTL, certificate, and endpoint or origin configuration.
- Test name resolution and delivery from the intended client and inspect the matching DNS or access logs.
When to use it
- Create records in a hosted zone when Route 53 must answer authoritatively; configure Resolver endpoints and rules when recursive queries must cross network boundaries.
- Use weighted routing for configured traffic proportions, latency routing for AWS-Region latency selection, failover routing for primary/secondary health, and geolocation routing for client-location rules.
- Choose Amazon CloudFront when HTTP delivery and caching are required; choose AWS Global Accelerator when supported endpoint traffic needs acceleration without caching.
- Use DNS query logs to investigate name-resolution activity and CloudFront access logs to investigate viewer requests handled by a distribution.
Security and governance implications
- Keep internal records in private hosted zones associated only with authorized VPCs and networks.
- Restrict access to DNS and delivery logs and attach certificates only to the intended endpoint and Region.
Failure signals and diagnosis
- For private DNS, inspect zone association, VPC DNS settings, forwarding rules, endpoint IPs, routes, and filters.
- For wrong routing, inspect record type, policy values, health state, evaluation, and resolver cache TTL.
- For distribution problems, separate DNS, TLS, edge/cache behavior, origin health, endpoint health, and logs.
More detail
- Keep private hosted-zone associations and hybrid Resolver inbound and outbound paths distinct.
- Translate proportional, latency, failover, or location requirements into the matching Route 53 routing policy and health behavior.
- Configure the query-log and delivery-log surface that observes the layer under investigation.
Ready for the quiz?
- On-premises clients cannot resolve a private hosted-zone name. Which evidence separates a zone-association problem from a Route 53 Resolver forwarding or network-path problem?
- Which traffic requirement calls for weighted, latency, failover, or geolocation routing?
- Which log source distinguishes queries handled by VPC resolvers from queries received for a public hosted zone?
Related objectives
- D5.2 — Task 5.2: Configure domains, DNS services, and content delivery.
- 5.2.1 — Configure DNS (for example, Route 53 Resolver).
- 5.2.2 — Implement Route 53 routing policies, configurations, and query logging.
- 5.2.3 — Configure content and service distribution (for example, CloudFront, AWS Global Accelerator).