Question

A company hosts an application at app.example.com that must be reachable from the public internet as well as from resources inside a VPC. Public clients should resolve the name to a CloudFront distribution, while resources within the VPC must resolve the same name to an internal Application Load Balancer for a lower-latency private path. The public authoritative zone for example.com already exists in Route 53. What is the most appropriate DNS design to satisfy both requirements?

Accepted Answer

Create a Route 53 private hosted zone for example.com associated with the VPC containing an app record pointing to the internal ALB, and keep the public hosted zone record pointing to CloudFront.

Answer

Add both the CloudFront and internal ALB records to the public hosted zone as a weighted record set so clients receive whichever endpoint is appropriate.

Answer

Configure a Route 53 Resolver outbound endpoint with a forwarding rule for example.com pointing to the internal ALB's IP addresses.

Answer

Use a Route 53 geolocation routing policy in the public hosted zone to send VPC-sourced queries to the ALB and internet queries to CloudFront.