Question

A company runs a multi-account AWS Organizations environment with dozens of VPCs connected through a central AWS Transit Gateway. An on-premises data center is connected via AWS Direct Connect. The company needs bidirectional DNS resolution: EC2 instances in any VPC must resolve on-premises private hostnames, and on-premises servers must resolve private Route 53 hosted zone records used across the organization. The solution must be centrally managed in a shared networking account and minimize the number of resolver endpoints deployed. Which approach meets these requirements?

Accepted Answer

In the networking account, deploy a Route 53 Resolver inbound endpoint and an outbound endpoint in a central VPC, create resolver rules for the on-premises domain, and share those rules and the private hosted zones across the organization using AWS Resource Access Manager.

Answer

Deploy Route 53 Resolver inbound and outbound endpoints in every VPC across all accounts, and configure conditional forwarding rules independently within each account.

Answer

Configure the on-premises DNS servers to forward all queries to the Amazon-provided VPC resolver at the 169.254.169.253 address over the Direct Connect connection.

Answer

Create a public Route 53 hosted zone for the private domains and use Transit Gateway multicast to distribute DNS records to all VPCs and the on-premises network.