wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

The logins that take thirty seconds, and the lookup nobody wrote a rule for

Hybrid DNS is finished and correct: an outbound endpoint, a forwarding rule for the corporate domain, associated with the VPC. Names resolve. Every service that talks to the data centre works.

What does not work is logging in. SSH to any instance hangs for around thirty seconds before the prompt appears, and the domain-joined application does the same thing on every authentication. Both eventually succeed.

Place what resolves the lookup that is timing out. The forward direction already works and must keep working.
Components — tap one, then tap a slot on the diagram
!A thirty-second pause on every SSH and every domain authentication, ending in success. No errors, no failures, nothing in the application log — the workload is merely slow in a way that gets blamed on the network.This is a DNS problem that never shows up as a DNS problem, because the thing timing out is a lookup the application never asked for.

Boundaries, outermost first: Platform VPC: VPC Resolver (forward rule only), The instance (30s to a prompt; FAILED: waiting), Outbound endpoint (already built) Corporate data centre: Corporate resolver (holds the PTRs), an empty slot for the what the resolver has to match Connections: The instance calls VPC Resolver — who is 10.0.1.161? (step 1) VPC Resolver calls Outbound endpoint — no rule matches (step 2) what the resolver has to match controls Corporate resolver — in-addr.arpa zones (step 3) Corporate resolver calls VPC Resolver — answers (step 4)

Corporate resolverholds the PTRs
VPC Resolverforward rule only
The instance30s to a promptwaiting
Outbound endpointalready built