Route53 - Ping Private Hosted Zone

Question

I have created the following resources:

• VPC with the custom DHCP options (Screenshot below)
• Route53 - Private Hosted zone with xyz.local
• Attached VPC to Hosted Zone
• Two EC2 instances (CentOS) inside the VPC created above
• A record under Private Hosted Zone pointing to each EC2 Instance (ec21.xyz.local, ec22.xyz.local)

Here is the output of my dig command:

But when I do ping xyz.local, I am not able to ping it. As per my understanding, I should be able to ping it.

Please correct my understanding here and help me to understand what else I have missed.

Answer 1

Amazon EC2 instances only permit inbound access if there is a matching rule in a Security Group associated with the instance.

To allow incoming 'ping' request, you will need to add a rule that permits ICMP traffic in the Inbound rules list:

This will allow the request to reach the instance. The instance will be able to return the response because Security Groups are stateful.