Question

A financial services company is designing a hub-and-spoke network using AWS Transit Gateway to connect 40 VPCs across a single Region. Instances in the spoke VPCs must be able to resolve the private DNS hostnames of AWS interface endpoints (via PrivateLink) that are hosted in a centralized shared-services VPC and reached over the Transit Gateway. During testing, engineers find that instances in spoke VPCs can reach the shared-services VPC over the TGW but receive public IP addresses when resolving the endpoint's DNS name, causing traffic to leave via the internet instead of staying private. Which configuration change resolves this while keeping the design centralized?

Accepted Answer

Disable private DNS on the interface endpoint in the shared-services VPC and create a Route 53 private hosted zone for the service's regional DNS name, associating it with all spoke VPCs (and the shared-services VPC) so queries resolve to the endpoint's private IPs.

Answer

Enable DNS support on the Transit Gateway VPC attachments so that DNS queries are automatically forwarded across the TGW to the shared-services VPC resolver.

Answer

Create an interface endpoint with private DNS enabled in each of the 40 spoke VPCs so every VPC resolves the service name to its own local private IPs.

Answer

Configure Route 53 Resolver outbound endpoints in each spoke VPC with forwarding rules pointing at the shared-services VPC's inbound endpoint for the service domain.