Update AWS Route53 Records within EC2 instance without internet access

Question

I have a ec2 instance on a private subnet without internet access in a vpc.

I want to change an A record from a Route53 Zone using aws route53 change-resource-record-sets.

The EC2 Instance has the appropriate Role with needed Policies attached to access Route53.

When using the aws route53 command within the EC2 Instance I get a timeout.

Using the same command on a public EC2 Instance with the same IAM role and policies works.

Do the Instance where I use the aws cli command needs internet access to update route53 records?

Answer 1

Yes, the AWS CLI accesses the AWS API over the internet.

In some cases, you can use a VPC endpoint to access an AWS API without giving the instance access to the Internet, but Route 53 is not currently one of these services.