Troubleshooting AWS CloudShell VPC Connectivity Issues

Select Language:

If you’re trying to resolve specific domain names within an AWS CloudShell environment connected to a Virtual Private Cloud (VPC), you might encounter some issues because CloudShell doesn’t automatically use your VPC’s DNS settings. This can cause problems when attempting to resolve internal or custom domains.

First, understand that connecting CloudShell to your VPC doesn’t automatically configure DNS for you. Unlike EC2 instances, which usually recognize your VPC’s DNS entries by default, CloudShell runs in an environment that isn’t configured to recognize your VPC’s local DNS zone.

For example, I set up a DNS server named “kobayashi” in my VPC using a DHCP options set. When I create an EC2 instance in that VPC, it automatically knows how to find “kobayashi” by checking /etc/hosts. But CloudShell doesn’t do this by default. When I check, I see the following configurations:

/etc/hosts:
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
172.31.255.194 ip-10-0-0-155.ap-northeast-1.compute.internal ip-10-0-0-155

/etd/resolv.conf:
search ap-northeast-1.compute.internal
nameserver 127.0.0.11
options ndots:0

You’ll notice the environment is not explicitly aware of your custom DNS zone.

To resolve this issue, you can install the bind-utils package, which provides the dig command. This tool is useful to test and verify domain resolutions, including public domains like “google.com”. Since CloudShell doesn’t have dig installed by default, you’ll need to install it manually:

bash
sudo dnf install bind-utils

Once installed, you can run a command like:

bash
dig google.com

This helps you check if the DNS resolution is working properly and confirms whether CloudShell can reach outside domains. If internal DNS names aren’t resolving, you might need to adjust your VPC’s DNS settings or add specific DNS entries to ensure CloudShell and other instances can recognize them.

In summary, when working with CloudShell in a VPC, remember that DNS resolution isn’t automatic. Installing tools like dig and customizing your DNS configuration can help ensure you can resolve both internal and external domain names effectively.