You created a new VPC and added resource records to an existing Route 53 private hosted zone so that those names should resolve inside the VPC. What final action completes the setup so the VPC can resolve the private zone names?

To resolve names in a private hosted zone from a VPC, you must explicitly associate that private hosted zone with the VPC. This step links the DNS records in the private hosted zone to the VPC's DNS resolver. Without this association, the VPC's DNS resolver will not know to query the private hosted zone for the specified domain names. Adding security group rules or updating NACLs is unnecessary because Route 53 Resolver endpoints are internal AWS services accessible by default within a VPC. Similarly, adding routes to subnet route tables is not required as the VPC's internal DNS resolution mechanism handles the routing to the Resolver.