</>Học Dev
Bài học

Tuần 4 - Ngày 5: Route 53 Advanced

Tuần 4 – Ngày 5

Tuần 4 - Ngày 5: Route 53 Advanced

Mục tiêu học tập

  • Hiểu các routing policies nâng cao
  • Nắm vững health checks và failover
  • Biết cách implement DNS-based architectures

1. Route 53 Routing Policies

Overview

┌─────────────────────────────────────────────────────────┐│ROUTE53ROUTINGPOLICIES││││1.Simple-Singleresource,nohealthcheck││2.Weighted-Distributetrafficbyweight││3.Latency-Routetolowestlatencyregion││4.Failover-Active-passivefailover││5.Geolocation-Routebyuserlocation││6.Geoproximity-Routebygeographicdistance││7.IP-based-RoutebyclientIP││8.Multivalue-Returnmultiplehealthyvalues│└─────────────────────────────────────────────────────────┘

Weighted Routing

┌─────────────────────────────────────────────────────────┐│WeightedRouting││││app.example.com│││││├──RecordA:Weight70→10.0.1.1(Primary)│││││├──RecordB:Weight20→10.0.2.1(Secondary)│││││└──RecordC:Weight10→10.0.3.1(Canary)││││TrafficDistribution:││-70%→Primary││-20%→Secondary││-10%→Canary│└─────────────────────────────────────────────────────────┘Usecases:-Blue/Greendeployments-A/Btesting-Gradualmigration

Latency Routing

┌─────────────────────────────────────────────────────────┐│LatencyRouting││││UserinSingapore│││││▼││┌─────────────┐│││Route53││││Latency││││Check│││└──────┬──────┘│││││┌──────┴─────────────────────────────────────┐││││││▼Lowestlatency▼││ap-southeast-1us-east-1eu-west-1││(50ms)✓(200ms)(250ms)│└─────────────────────────────────────────────────────────┘Note:LatencyismeasuredAWSregiontouser,notabsolute

Geolocation Routing

┌─────────────────────────────────────────────────────────┐│GeolocationRouting││││┌─────────────────────────────────────────────────┐│││Record1:Location=Asia││││→ap-southeast-1servers│││├─────────────────────────────────────────────────┤│││Record2:Location=Europe││││→eu-west-1servers│││├─────────────────────────────────────────────────┤│││Record3:Location=Default││││→us-east-1servers(fallback)│││└─────────────────────────────────────────────────┘││││Usecases:││-Contentlocalization││-Regulatorycompliance(dataresidency)││-Loadbalancingbyregion│└─────────────────────────────────────────────────────────┘

Geoproximity Routing

┌─────────────────────────────────────────────────────────┐│GeoproximityRouting││(TrafficFlowonly)││││ResourceswithBias:││┌─────────────────────────────────────────────────┐│││Region:us-east-1││││Bias:+25││││→Attractsmoretrafficfromnearbyareas│││├─────────────────────────────────────────────────┤│││Region:us-west-2││││Bias:-10││││→Pushestrafficaway│││└─────────────────────────────────────────────────┘││││Biasrange:-99to+99││Usecase:Shifttrafficduringmaintenance│└─────────────────────────────────────────────────────────┘

IP-based Routing

┌─────────────────────────────────────────────────────────┐│IP-basedRouting││││CIDRCollections:││┌─────────────────────────────────────────────────┐│││Collection:"CorporateIPs"││││CIDRs:203.0.113.0/24,198.51.100.0/24││││→Routetointernalendpoints│││├─────────────────────────────────────────────────┤│││Collection:"PartnerIPs"││││CIDRs:192.0.2.0/24││││→Routetopartnerendpoints│││├─────────────────────────────────────────────────┤│││Default││││→Routetopublicendpoints│││└─────────────────────────────────────────────────┘││││Usecases:││-ISP-specificrouting││-Corporatenetworkoptimization│└─────────────────────────────────────────────────────────┘

2. Health Checks

Types of Health Checks

1. Endpoint Health Checks:
   - HTTP/HTTPS/TCP
   - Check specific endpoint
   - Configure threshold

2. Calculated Health Checks:
   - Combine multiple health checks
   - AND, OR logic

3. CloudWatch Alarm Health Checks:
   - Based on CloudWatch alarm state
   - For private resources

Health Check Configuration

┌─────────────────────────────────────────────────────────┐│HealthCheckSettings││││Protocol:HTTPS││Endpoint:api.example.com││Port:443││Path:/health││││RequestInterval:30seconds(or10forfast)││FailureThreshold:3││││StringMatching:"healthy"(optional)││LatencyGraphs:Enabled││││Regions:All(recommended)││Orspecificregions│└─────────────────────────────────────────────────────────┘

Calculated Health Checks

┌─────────────────────────────────────────────────────────┐│CalculatedHealthCheck││││┌─────────────────────────────────────────────────┐│││ParentHealthCheck││││││││Logic:Reporthealthywhenatleast2of3││││childhealthchecksarehealthy││││││││┌──────────┐┌──────────┐┌──────────┐│││││Child1││Child2││Child3││││││(Web)││(API)││(DB)││││││Healthy││Healthy││Unhealthy│││││└──────────┘└──────────┘└──────────┘││││││││Result:Parent=HEALTHY(2of3)│││└─────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘

3. Failover Routing

Active-Passive Failover

┌─────────────────────────────────────────────────────────┐│Active-PassiveFailover││││app.example.com│││││├─►Primary(Active)│││-Failovertype:Primary│││-Healthcheck:hc-primary│││-Target:10.0.1.1(mainserver)│││││└─►Secondary(Passive)││-Failovertype:Secondary││-Healthcheck:optional││-Target:10.0.2.1(backupserver)││││Flow:││1.Primaryhealthy→TraffictoPrimary││2.Primaryfails→TraffictoSecondary││3.Primaryrecovers→TrafficbacktoPrimary│└─────────────────────────────────────────────────────────┘

Active-Active with Health Checks

┌─────────────────────────────────────────────────────────┐│Active-ActivewithWeighted+Health││││┌─────────────────────────────────────────────────┐│││Record1:Weight50,HealthCheckenabled││││→us-east-1(Healthy✓)│││├─────────────────────────────────────────────────┤│││Record2:Weight50,HealthCheckenabled││││→us-west-2(Unhealthy✗)│││└─────────────────────────────────────────────────┘││││Result:100%traffictous-east-1││(Unhealthyrecordsremovedfromresponses)│└─────────────────────────────────────────────────────────┘

4. Route 53 Resolver

DNS Resolution for Hybrid

┌─────────────────────────────────────────────────────────┐│Route53Resolver││││AWS→On-Premises(Outbound):││┌─────────────────────────────────────────────────┐│││VPC││││┌──────────────┐│││││Outbound│──►corp.internal.com│││││Endpoint│(Forwardtoon-premDNS)││││└──────────────┘│││└─────────────────────────────────────────────────┘││││On-Premises→AWS(Inbound):││┌─────────────────────────────────────────────────┐│││VPC││││┌──────────────┐│││││Inbound│◄──aws.example.com│││││Endpoint│(On-premforwardshere)││││└──────────────┘│││└─────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘

Resolver Rules

┌─────────────────────────────────────────────────────────┐│ResolverRules││││Rule1:Forward││┌─────────────────────────────────────────────────┐│││Domain:corp.internal││││Type:Forward││││Target:192.168.1.10,192.168.1.11││││(On-premisesDNSservers)│││└─────────────────────────────────────────────────┘││││Rule2:System││┌─────────────────────────────────────────────────┐│││Domain:amazonaws.com││││Type:System││││Action:UseRoute53Resolver│││└─────────────────────────────────────────────────┘││││CansharerulesviaRAMacrossaccounts│└─────────────────────────────────────────────────────────┘

5. Private Hosted Zones

Cross-Account PHZ Sharing

┌─────────────────────────────────────────────────────────┐│PrivateHostedZoneSharing││││┌─────────────────────────────────────────────────┐│││AccountA(DNSOwner)││││││││PrivateHostedZone:internal.company.com││││AssociatedVPCs:VPC-A││││││││+AuthorizeAccountB'sVPC│││└─────────────────────────────────────────────────┘│││││Authorization│││││┌─────────────────────────────────────────────────┐│││AccountB││││││││VPC-B:AssociateswithPHZ││││Canresolveinternal.company.com│││└─────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘Steps:1.AccountAcreatesPHZandassociatesVPC-A2.AccountAauthorizesAccountB'sVPC3.AccountBassociatesVPC-BwithPHZ4.AccountAdeletesauthorization(optional)

6. DNS Best Practices

TTL Strategy

RecordTypeRecommendedTTL───────────────────────────────────Staticrecords86400(1day)Loadbalanced60-300secondsFailover60secondsorlessDuringmigration300→60→original

Alias vs CNAME

┌─────────────────────────────────────────────────────────┐│ALIASvsCNAME││││ALIAS(AWS-specific):││✓Canbeusedatzoneapex(example.com)││✓Nochargeforqueries││✓Nativehealthcheckintegration││✓ReturnsA/AAAArecords││││CNAME:││✗Cannotbeusedatzoneapex││✗Chargedforqueries││✗AdditionalDNSlookuprequired││✓Workswithnon-AWSresources││││Recommendation:UseALIASforAWSresources│└─────────────────────────────────────────────────────────┘

7. Câu hỏi ôn tập

  1. 8 routing policies của Route 53 là gì?

    Xem đáp án

    (1) Simple — single resource, no health check, (2) Weighted — % traffic theo weight, A/B testing, (3) Latency-based — route đến Region có lowest latency, (4) Failover — active-passive với health check, (5) Geolocation — route theo country/continent của user, (6) Geoproximity — route theo geographic proximity với bias adjustment (Traffic Flow only), (7) Multivalue Answer — multiple healthy IPs, (8) IP-based — route theo client IP CIDR prefix (2023 feature).

  2. Geolocation khác Latency routing như thế nào?

    Xem đáp án

    Geolocation: route dựa trên địa lý vật lý (country, continent, subdivision) — user từ Vietnam luôn đến endpoint được assign cho Vietnam/Asia, bất kể latency. Dùng cho compliance (data residency), localization (show Vietnamese content), content restrictions. Latency-based: route đến Region có latency thấp nhất — user từ Vietnam có thể đến Singapore hay Tokyo tùy latency tốt hơn. Dùng cho performance optimization.

  3. Health check types là gì?

    Xem đáp án

    3 types: (1) Endpoint health checks — monitor HTTP/HTTPS/TCP endpoint trực tiếp (Route 53 health checkers từ nhiều Regions), (2) Calculated health checks — combine status của multiple health checks (AND/OR logic), (3) CloudWatch alarm health checks — trạng thái dựa trên CloudWatch alarm state. Health check frequency: 30s (standard) hoặc 10s (fast, thêm chi phí). Threshold: 3 của 5 health checkers fail → unhealthy.

  4. Route 53 Resolver dùng để làm gì?

    Xem đáp án

    Route 53 Resolver là DNS resolver trong VPC (mặc định tại 169.254.169.253). Resolver Endpoints cho hybrid connectivity: Inbound Endpoint — on-premises DNS forward queries đến AWS để resolve Route 53 private zones; Outbound Endpoint — EC2 trong VPC forward queries đến on-premises DNS servers. Resolver Rules define which domains forward to which DNS servers. Cần cho Split-horizon DNS (same domain, different IPs internal vs external).

  5. ALIAS record khác CNAME như thế nào?

    Xem đáp án

    CNAME: DNS standard, map hostname → hostname khác, không dùng được tại apex domain (example.com bare domain), tính phí query. ALIAS: Route 53 extension, map hostname → AWS resources (ALB DNS name, CloudFront, S3 website, API GW, Elastic Beanstalk), dùng được tại apex domain, không tính phí query riêng, support health check, AWS auto-update IP nếu resource IP thay đổi. Luôn ưu tiên ALIAS cho AWS resources.

8. Bài tập thực hành

  • Create weighted routing records
  • Setup health checks với failover
  • Configure Route 53 Resolver rules
  • Test failover scenarios

Tài liệu tham khảo chính thức

Ngày tiếp theo: Quiz tổng kết Tuần 4