Question

A financial services company runs workloads across multiple VPCs connected via Transit Gateway. Security requires that all outbound DNS queries from EC2 instances be filtered so that instances can resolve only an approved allow-list of external domains, and all other domain lookups must be blocked and logged. The solution must apply centrally without installing agents on the instances. Which implementation meets these requirements?

Accepted Answer

Create Route 53 Resolver DNS Firewall rule groups with domain lists set to ALLOW for approved domains and a BLOCK rule for all other domains, then associate the rule groups with the VPCs and enable query logging.

Answer

Configure Route 53 Resolver outbound endpoints with forwarding rules that forward only the approved domains to an external resolver and drop everything else.

Answer

Deploy a network ACL on each subnet that denies UDP/TCP port 53 traffic to any destination except the approved domain IP addresses.

Answer

Use a Route 53 private hosted zone containing only the approved domain records and disable recursive resolution for the VPC.