route53
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseAmazon Route 53
Amazon Route 53
Overview
概述
Domain expertise for configuring Amazon Route 53 DNS across the public and private resolution
paths: hosted zone records, traffic-steering routing policies, health checks, DNS Firewall,
Route 53 Profiles, VPC Resolver (also known as Route 53 Resolver) for hybrid and Outposts networks,
and Global Resolver.
This skill is a router. Each customer task maps to a procedure file under . Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
references/Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. All Route 53 Domains API calls are made in
regardless of where the customer works.
us-east-1本技能具备跨公网与私网解析路径配置Amazon Route 53 DNS的领域专业能力：包括托管区域记录、流量引导路由策略、健康检查、DNS防火墙、Route 53 Profiles、适用于混合云和Outposts网络的VPC Resolver（也称为Route 53 Resolver）以及Global Resolver。
本技能作为一个路由工具，每个客户任务都对应目录下的一个流程文件。执行操作前请完整阅读匹配的参考文档，然后遵循其中的约束条件和步骤。参考文件是独立完整的：每个文件都包含自身的决策表、约束条件、执行流程和故障排查内容。
references/连接AWS MCP服务器时，请通过该服务器执行命令（沙箱执行、审计日志、可观测性）；否则使用AWS CLI作为备选。所有Route 53 Domains API调用均在区域执行，无论客户所在区域如何。
us-east-1Which Route 53 task do you need?
您需要完成哪项Route 53任务？
| Goal | Reference |
|---|---|
| Point a hostname or zone apex at an IP, AWS resource, or hostname | creating a public DNS record |
| Split traffic across endpoints in a ratio (blue/green, canary, A/B) | splitting traffic with weighted routing |
| Fail over between two Regions for disaster recovery | configuring failover routing |
| Monitor whether an endpoint is up and get alerted | setting up a health check |
| Block malicious domains for a VPC at the resolver | blocking malicious domains |
| Work out which DNS Firewall rule wins for a domain across multiple rule groups | identifying the effective DNS Firewall rule |
| Apply one DNS config across many VPCs and accounts | configuring Route 53 Profiles |
| Fan DNS Firewall out across many accounts org-wide | centralizing DNS Firewall with Profiles |
| Resolve private DNS both ways across a hybrid network | resolving private DNS for hybrid networks |
| Run VPC Resolver locally on an AWS Outposts rack | running VPC Resolver on Outposts |
| Give on-premises and remote clients one anycast DNS endpoint | setting up Global Resolver |
| 目标 | 参考文档 |
|---|---|
| 将主机名或区域顶点指向IP、AWS资源或其他主机名 | 创建公网DNS记录 |
| 按比例在多个端点间拆分流量（蓝绿部署、金丝雀发布、A/B测试） | 使用加权路由拆分流量 |
| 在两个区域间进行故障转移以实现灾难恢复 | 配置故障转移路由 |
| 监控端点是否正常运行并接收告警 | 设置健康检查 |
| 在解析器层面为VPC阻止恶意域名 | 阻止恶意域名 |
| 确定跨多个规则组的域名对应的DNS防火墙生效规则 | 识别DNS防火墙生效规则 |
| 在多个VPC和账户间应用统一的DNS配置 | 配置Route 53 Profiles |
| 在整个组织的多个账户中推广DNS防火墙 | 通过Profiles集中管理DNS防火墙 |
| 在混合网络中双向解析私网DNS | 为混合网络解析私网DNS |
| 在AWS Outposts机架上本地运行VPC Resolver | 在Outposts上运行VPC Resolver |
| 为本地和远程客户端提供任播DNS端点 | 设置Global Resolver |
Routing notes
路由说明
- Records vs routing policies. A plain hostname-to-target mapping is the public DNS record task. Splitting or steering traffic (weighted, failover) is a separate routing-policy task with its own reference. Start from the customer's intent, not the record type.
- Health checks vs failover. A health check monitors an endpoint and raises alarms. The failover routing policy decides where traffic goes when a check fails. They are two references and are often used together: set up the health check, then wire it into failover.
- DNS Firewall for one VPC vs many accounts. Authoring rules for a VPC is the blocking reference. Fanning the same protection across accounts with Profiles and Firewall Manager is the centralizing reference.
- DNS Firewall authoring vs diagnosis. Creating or changing rules is the blocking reference. Working out which rule already wins for a domain when several rule groups are associated (a read and diagnostic task) is the identifying-the-effective-rule reference.
- Profiles, two entry points. General Profile setup (attach resources, share via RAM, cost and visibility tradeoffs) is the configuring-Profiles reference. Using Profiles specifically to scale DNS Firewall org-wide is the centralizing reference.
- VPC Resolver, three contexts. In-Region hybrid resolution, the Outposts-local resolver, and the Global Resolver anycast endpoint are three separate references. Match the reference to where the resolver runs.
- 记录 vs 路由策略：单纯的主机名到目标的映射属于公网DNS记录任务。拆分或引导流量（加权、故障转移）是独立的路由策略任务，有其对应的参考文档。请从客户的需求意图出发，而非记录类型。
- 健康检查 vs 故障转移：健康检查用于监控端点并触发告警。故障转移路由策略用于决定检查失败时流量的去向。这是两个独立的参考文档，通常配合使用：先设置健康检查，再将其接入故障转移配置。
- 单VPC的DNS防火墙 vs 多账户的DNS防火墙：为单个VPC编写规则对应阻止恶意域名的参考文档。通过Profiles和Firewall Manager在多个账户中推广相同防护措施对应集中管理的参考文档。
- DNS防火墙规则编写 vs 诊断：创建或修改规则对应阻止恶意域名的参考文档。当关联多个规则组时，确定某个域名对应的生效规则（读取和诊断任务）对应识别生效规则的参考文档。
- Profiles的两个入口：通用Profile设置（关联资源、通过RAM共享、成本与可见性权衡）对应配置Profiles的参考文档。专门使用Profiles在整个组织内扩展DNS防火墙对应集中管理的参考文档。
- VPC Resolver的三种场景：区域内混合解析、Outposts本地解析器、Global Resolver任播端点是三个独立的参考文档。请根据解析器的运行位置匹配对应的参考文档。
Cross-service work
跨服务工作
Pointing a custom domain at a CloudFront distribution, or failing over between CloudFront
distributions, is cross-service work owned by the separate skill. Use this
skill for the Route 53 side of pure-Route 53 tasks only.
route53-cloudfront将自定义域名指向CloudFront分发，或在多个CloudFront分发间进行故障转移，属于跨服务工作，由独立的技能负责。本技能仅适用于纯Route 53任务的Route 53侧配置。
route53-cloudfrontSecurity Considerations
安全注意事项
These apply across the Route 53 tasks below; each reference repeats the ones load-bearing for its
workflow.
- You SHOULD use least-privilege IAM credentials provisioned through IAM roles (instance profiles,
SSO/IAM Identity Center session credentials, or ) rather than long-lived IAM user access keys, and prefer read-only credentials for inspection steps.
aws sts assume-role - You SHOULD recommend encrypted DNS transport (DoT or DoH) over plaintext Do53 for resolver client populations, since Do53 exposes queried domain names to on-path observers.
- You MUST scope resolver-endpoint security group rules on port 53 to the on-premises CIDR ranges or
known DNS server IPs, never .
0.0.0.0/0 - You MUST encrypt query log and notification destinations at rest: KMS on CloudWatch Logs log groups, SSE-S3/SSE-KMS on S3 buckets, server-side encryption (SSE) on a Data Firehose stream, and SSE on SNS topics, because DNS query logs and health-check notifications can reveal infrastructure topology.
- For Global Resolver, you MUST treat access-token returned at create time as a secret; store it in AWS Secrets Manager rather than in plaintext, and validate which client populations each DNS view authorizes.
value
以下注意事项适用于所有Route 53任务；每个参考文档会重复列出与其工作流程相关的关键注意事项。
- 您应使用通过IAM角色（实例配置文件、SSO/IAM Identity Center会话凭证或）提供的最小权限IAM凭证，而非长期有效的IAM用户访问密钥；在检查步骤中优先使用只读凭证。
aws sts assume-role - 对于解析器客户端群体，您应推荐使用加密DNS传输（DoT或DoH）而非明文Do53，因为Do53会将查询的域名暴露给路径上的观察者。
- 您必须将解析器端点安全组的53端口规则限定为本地CIDR范围或已知DNS服务器IP，绝不能设置为。
0.0.0.0/0 - 您必须对查询日志和通知目标进行静态加密：CloudWatch Logs日志组使用KMS加密，S3存储桶使用SSE-S3/SSE-KMS加密，Data Firehose流使用服务器端加密（SSE），SNS主题使用SSE加密，因为DNS查询日志和健康检查通知可能泄露基础设施拓扑信息。
- 对于Global Resolver，您必须将创建时返回的访问令牌视为机密信息；将其存储在AWS Secrets Manager中而非明文存储，并验证每个DNS视图授权的客户端群体。
value