Question

A company runs applications on-premises connected to an AWS VPC via an AWS Direct Connect connection. The security team wants on-premises servers to access Amazon Kinesis Data Streams privately, without traffic traversing the public internet, by using an interface VPC endpoint (powered by AWS PrivateLink). After creating the interface endpoint in the VPC, on-premises applications still cannot resolve the Kinesis endpoint DNS name to the private endpoint IP addresses. What is the recommended way to enable correct private DNS resolution for the on-premises hosts?

Accepted Answer

Create an Amazon Route 53 Resolver inbound endpoint in the VPC and configure on-premises DNS servers to forward queries for the AWS service domain to the inbound endpoint IP addresses.

Answer

Enable the 'Private DNS name' option on the interface endpoint and rely on it directly; on-premises resolvers will automatically use the private hosted zone.

Answer

Add the interface endpoint's private IP addresses to a public Route 53 hosted zone so on-premises hosts can resolve them over the internet.

Answer

Attach an internet gateway to the VPC and route on-premises DNS queries through a NAT gateway to reach the AWS service's public DNS.