A transit authority requires bidirectional hybrid DNS: on-premises…

Question

A transit authority requires bidirectional hybrid DNS: on-premises resolvers must answer queries for private Route 53 records in AWS, and domain-joined jump hosts in AWS must resolve corporate DNS names. Which approach meets this need?

Accepted Answer

Deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules so on-premises and AWS DNS can resolve each other's private namespaces. — Hybrid DNS is a two-way street: the garage needs to find buses in AWS, and AWS jump boxes need to find names back at HQ. Route 53 Resolver inbound and outbound endpoints plus forwarding rules build that street. Public zones or hosts files are band-aids, not an architecture.

Answer

Create only public Route 53 hosted zones for all private application names and resolve them over the internet.

Answer

Hard-code /etc/hosts files on every jump host and workstation, and forbid DNS changes across environments.

Answer

Use CloudFront alias records exclusively, because Resolver endpoints cannot forward queries to on-premises DNS.

A transit authority requires bidirectional hybrid DNS: on-premises resolvers must answer queries for private Route 53 records in AWS, and domain-joined jump hosts in AWS must resolve corporate DNS names. Which approach meets this need?

Short Explanation

Full Explanation