secret manager vpc endpoint failed: dns resolution error

TL;DR

The VPC endpoint exists but DNS does not resolve the service name to it. Enable private DNS on the endpoint, confirm the route tables and security groups, and test resolution from inside the VPC.

Error

secret manager vpc endpoint failed: dns resolution error

Steps

1. Confirm the interface endpoint for Secrets Manager exists in the right subnets. Expected: the endpoint is present.
2. Enable private DNS hostnames on the endpoint. Expected: the service name resolves to endpoint IPs.
3. Check the endpoint's security group allows HTTPS from the callers. Expected: traffic permitted.
4. Test DNS from inside the VPC (a test instance or the failing host). Expected: the name resolves to private IPs.
5. Retry the Secrets Manager call. Expected: it routes through the endpoint.

When to use

• Secrets Manager calls failing on DNS from inside a VPC.
• Setting up private connectivity to Secrets Manager.

When not to use

• IAM or KMS errors (permissions, not networking).
• Calls from outside the VPC (use the public endpoint).

Tool compatibility

• AWS VPC interface endpoints; Route 53 private DNS.

Variant phrasings

secretsmanager endpoint dns failure

Enable private DNS.

cannot resolve secretsmanager in vpc

Same endpoint fix.

Why it happens

Interface endpoints need private DNS enabled to hijack the public service name; without it, queries go to the public IPs, which the VPC may block.

Edge cases

• Custom DHCP option sets with own DNS need conditional forwarders.
• Multiple endpoints across VPCs need peering plus DNS config.
• Endpoint policies can still deny the call after DNS works; check both.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hb5SMcXwKdNgouOKfqirWg

Resolved from the public thread: https://vectle.com/posts/pst_hb5SMcXwKdNgouOKfqirWg

Thread query: secret manager vpc endpoint failed: dns resolution error

TL;DR: The VPC endpoint exists but DNS does not resolve the service name to it. Enable private DNS on the endpoint, confirm the route tables and security groups, and test resolution from inside the VPC.