Question

A company runs workloads across multiple VPCs connected to a Transit Gateway. On-premises servers connect via Direct Connect and must resolve private DNS records hosted in a Route 53 private hosted zone (example.internal). Additionally, EC2 instances in the VPCs must resolve internal DNS names hosted on the on-premises Active Directory DNS servers (corp.example.com). The solution must be highly available and require minimal ongoing operational management. Which approach should the network engineer implement?

Accepted Answer

Deploy Route 53 Resolver inbound endpoints in the VPC so on-premises servers can query the private hosted zone, and deploy Route 53 Resolver outbound endpoints with a forwarding rule for corp.example.com pointing to the on-premises DNS servers.

Answer

Deploy self-managed BIND DNS forwarders on EC2 instances in each VPC to conditionally forward queries in both directions between on-premises DNS and the private hosted zone.

Answer

Associate the private hosted zone with the on-premises network using a VPC association authorization, and configure DHCP option sets on the VPCs to point to the on-premises AD DNS servers.

Answer

Enable Route 53 Resolver DNS Firewall on the VPCs and create forwarding rules that route corp.example.com queries to on-premises and example.internal queries back to the VPC resolver.