Question

A financial services company runs 40 workload accounts under AWS Organizations, all connected through a central networking account using AWS Transit Gateway. The security team requires that all outbound DNS queries from every VPC be filtered against a managed blocklist of malicious domains, and that this filtering be enforced centrally without requiring each workload team to configure anything in their own accounts. The solution must allow the security team to update the blocklist in one place and have it apply everywhere. Which approach best meets these requirements?

Accepted Answer

Create Route 53 Resolver DNS Firewall rule groups in the central networking account, share them with the organization via AWS Resource Access Manager (RAM), and associate the shared rule groups with each workload VPC.

Answer

Deploy a self-managed DNS proxy fleet in the central networking account and use an SCP to force all workload accounts to route DNS traffic through it.

Answer

Enable Amazon GuardDuty DNS monitoring in every workload account and use an EventBridge rule to block flagged domains at the security group level.

Answer

Configure Route 53 Resolver DNS Firewall rule groups independently in each of the 40 workload accounts and use AWS Config to detect drift from the approved blocklist.