Why I built this?
I wanted to actually build a hybrid DNS environment and see the DNS queries travel between an on-premises environment and AWS.
My lab ended up having two separate DNS requirements:
- A public DNS name for my application: app.xcv.publicvm.com
- A private DNS namespace inside AWS: aws.internal
These are the 2 hosted zones I created in Route53:
The interesting part was making my on-premises Linux DNS server — which is also my MariaDB server at 192.168.1.10 — resolve a private AWS RDS name: rds.aws.internal.
The Architecture
The DNS pieces and why they exist:
1.Public DNS - app.xcv.publicvm.com
In my Public hosted zone I created failover routing with 2 A records:
app.xcv.publicvm.com
- primary -> 13.206.252.123
- failover -> 13.233.70.186
This is the also the DNS record that my application lives on.
2.Private DNS - aws.internal
I created a private hosted zone: aws.internal. This zone isn't resolvable publicly. This simply has a CNAME that points to my RDS' endpoint.
3. On-premise DNS - onprem.example.com
My on-premises environment has a Linux server at 192.168.1.10. This is also my mariadb server (which is ofcourse not a good practice but laziness 😁)
Now, we have 2 DNS authorities:
- On prem - onprem.example.com
- Route53 - aws.internal
And the good part is neither needs to become authoritative for the other environment (Because my DNS is not greedy like humans 😁). Instead, we forward queries.
Now, The problem!
There has to be a problem for us to provide a solution! Imagine, an application that sits on-premise wants to resolve rds.aws.internal -> 192.168.1.10(A.K.A on-premise DNS) . This fails. Because our on-premise isn't authoritative for aws.internal(It's a private hosted zone on AWS).
You can beat me up and say - "Add a static record on the On-premise DNS server".
I'd say hold my beer, this is why my setup exists:
- Adding a static entry is not a good hybrid architecture practice.
- RDS is owned by AWS, what if it changes the IP?
- And lastly, I'd say meet our friend - Route53 resolver Inbound Endpoint.
what is a Route53 resolver Inbound Endpoint ?
An Inbound Resolver Endpoint is used when DNS queries are coming into AWS from an external network(External is our on-premise network).
The flow (Roughly!) is:
The benefit : our on-prem DNS doesn't need to know how AWS works the magic! It just forwards anything *.aws.internal to the resolver.
And this is the validation that it worked:
