Private zones

A zone is public or private, fixed at creation.

Console
API
CLI
Go

On Create Zone, the Visibility card carries a Private zone switch. Turning it on reveals Select VPCs — pick at least one, or the form refuses with Choose at least one VPC.

POST /v1/zones
{
  "name": "internal.example.com",
  "visibility": "private",
  "vpcs": ["c3d4e5f6-a7b8-4901-c2d3-e4f5a6b7c8d9"]
}

basaltic dns zone create --name internal.example.com --visibility private \
  --vpcs c3d4e5f6-a7b8-4901-c2d3-e4f5a6b7c8d9

zone, err := dns.New(cfg).CreateZone(ctx, &dns.ZoneCreateRequest{
    Name: "internal.example.com",
    Visibility: basaltic.String("private"),
    VPCs: []string{"c3d4e5f6-a7b8-4901-c2d3-e4f5a6b7c8d9"},
})

A private zone answers only inside the VPCs associated with it, and needs at least one at creation. Attach or detach more later through the vpc-associations endpoints. Create uses vpcs; attach uses vpc. Supply an account-owned VPC UUID or CRN. Bare names return 400 because DNS requests do not fix a region. Missing VPCs, VPCs owned by another account, and CRNs for another region return 404. GET /v1/zones/{zone_id}/vpc-associations returns vpcs with meta. Each entry is a VPC resource with the same fields as the network VPC endpoint, including id, crn, name, CIDRs, tags, and timestamps. The CRN identifies the region. The console displays these resources directly rather than resolving a list of VPC IDs.

The console’s Create Zone form has a Visibility card with a private switch and the VPC list. Visibility is fixed at creation either way, so a zone made public stays public.VPC associations are supported only in the region configured for DNS. Cross-region associations are not currently supported.

The two mismatches are rejected rather than quietly corrected: a private zone with no vpcs, and a public zone that carries them, both answer 400.

Get started

Products

Platform

Help

Private zones

Private zones

​Private zones

Private zones