Hybrid DNS and Directory for a Phased Data Center Exit
A retailer is migrating 300 on-premises workloads to AWS over 18 months. On-premises DNS is Windows AD-integrated (two domain controllers) and resolves corp.example.com; several legacy apps hard-code those names. The company wants AWS workloads to resolve both corp.example.com and AWS-private names, and wants on-premises users to reach new AWS-hosted internal services by name. There is one AWS Direct Connect (1 Gbps) with a backup site-to-site VPN, and a single VPC per environment today. The network team refuses to run domain controllers on EC2 in AWS for the first 12 months due to licensing. Symptoms: pilot EC2 instances cannot resolve corp.example.com; an AWS-hosted service added to Route 53 private hosted zone is unreachable from on-premises.
1. Design DNS resolution in both directions given the no-DC-in-AWS constraint. Name the components and the forwarding rules.
Read the worked answer
Use Route 53 Resolver in the shared-services VPC with two endpoint types. Inbound endpoints (two IPs in different AZs) let on-premises resolvers forward queries for AWS private zones (e.g., aws.internal) to Route 53 Resolver over Direct Connect/VPN. Outbound endpoints with Resolver rules forward corp.example.com to the on-premises domain controllers' IPs across the DX/VPN. Associate the outbound rule with every VPC (or use the shared rule via AWS RAM from the owner account) so all VPCs inherit it. On-premises DNS conditional forwarders point aws.internal at the inbound endpoint IPs. Because the DCs stay on-premises, the outbound rule is the only path for AD name resolution - size it for query volume and keep the VPN as failover for the resolver endpoints.
For the pilot failures: the VPC must have enableDnsSupport and enableDnsHostnames set, and the instance's security group must allow UDP/TCP 53 to the outbound endpoint ENIs. For the unreachable AWS service: the private hosted zone must be associated with the VPC and the on-premises resolver must have the conditional forwarder to the inbound endpoint; also confirm the DX/VPN routes include the inbound endpoint subnet.
2. Twelve months later the licensing restriction lifts. What changes, and what would make you keep the hybrid DNS design anyway?
Read the worked answer
Deploy AWS Managed Microsoft AD in the shared-services VPC (two domain controllers managed by AWS), establish a forest trust with the on-premises forest (or migrate), and point the outbound Resolver rule at the Managed AD IPs instead of on-premises DCs. This removes the dependency on DX latency for authentication and lets you retire on-premises DCs as workloads move. Keep Route 53 Resolver endpoints regardless: even with Managed AD, AWS-private zones still need inbound resolution for any remaining on-premises consumers, and the outbound rule is still how VPCs reach any residual on-premises namespace. Keep the hybrid design if: some applications must remain on-premises past the migration window, regulatory or latency constraints require local authentication, or the on-premises estate includes non-AD namespaces (BIND zones) that you are not ready to migrate. The decision is driven by which namespaces remain authoritative off-AWS, not by whether AD runs in AWS.