Question

A company operates a shared services VPC (Account A) that hosts internal APIs resolvable via the domain internal.example.com. Application teams run workloads in several VPCs spread across Account B and Account C. All VPCs are attached to a Transit Gateway and have non-overlapping CIDRs. The networking team wants every application VPC to resolve records in the internal.example.com private hosted zone using native Route 53, without deploying Resolver endpoints or running custom DNS servers. What is the correct way to implement this?

Accepted Answer

Associate the private hosted zone with each application VPC, using cross-account authorization (create-vpc-association-authorization in Account A, then associate-vpc from Accounts B and C).

Answer

Create Route 53 Resolver inbound endpoints in the shared services VPC and configure forwarding rules in each application VPC pointing to those endpoint IPs.

Answer

Enable DNS resolution and DNS hostnames on the Transit Gateway so private hosted zone records propagate automatically to all attached VPCs.

Answer

Convert the private hosted zone to a public hosted zone and rely on the VPC's default DNS resolver to answer queries privately over the Transit Gateway.