Instructor: Okay. So now let's view
an advanced use case that comes up a lot in the exam
which is around Hybrid DNS.
So we have our region and there is the Route 53 Resolver.
And by default,
these resolver is going to automatically answer
DNS queries for local domain names for EC2 instances.
So for example, he's our VPC.
We have an EC2 instance.
There is this DNS name.
The Route 53 Resolver knows how to reply
to these queries so this is fine.
Any records in your private hosted zone as well
is going to be easy to answer too.
And records in public name servers.
For example, for a public hosted zone,
or any name server out there
that is public on the internet.
Now, if you want to resolve DNS queries
between your VPC and other private networks,
your own networks,
that has other DNS resolvers,
then you're going to need a Hybrid DNS.
So these networks can be peered to VPC,
for example,
or it could be an on-premises network
that is going to be connected to our VPC
through direct connect or AWS VPN.
So for this, let me introduce you
two concepts that we're going to see
with diagrams in the next slides.
So these are about resolver endpoints.
So there is two things.
There's an inbound endpoint and an outbound endpoint.
So inbound endpoints are allowing DNS resolvers
on your external networks
to forward DNS queries to your Route 53 Resolver
and answer these queries.
So these resolvers will help resolve domain names
for the resources of AWS.
For example, your EC2 instances,
or records that you create in your Route 53
private hosted zones.
So you would get both answers for your internal systems
and also for AWS private hosted zones.
And I will show you a diagram.
It will make a lot more sense very, very soon.
Now your outbound endpoint is to conditionally forward
DNS queries to your on-premises DNS resolvers.
And for this, we're going to create resolver rules
to forward them.
Now we associate these endpoints
with one or more VPCs within the same region.
And we create in two availability zones
for high availability.
Now each endpoint supports about 10,000 queries
per second per IP address.
And if you need more,
well, you create some more IP addresses.
And these resolvers remove the need from before
where people had to run their own DNS resolvers on AWS
and link them to their resolvers on-premises.
Now, these are managed resolver endpoints by AWS.
So let's have a look at a diagram.
It will make a lot more sense.
So let's take an example where we have an EC2 instance
and lives in a VPC.
And we have a private hosted zone that we create.
For example, aws.private.
And we have also an on-premises data center
that has a server.
Now, if you look at the EC2 instance,
I gave it a CNAME of app.aws.private.
Okay, this is a CNAME which is linked maybe to its EC2 DNS,
or it could be an A record linked to its private IP.
It doesn't matter, right?
Now, what's happening is that the server
at web.onpremise.private wants to access this EC2 instance.
And so first, the on-premises data center
and the AWS Cloud are going to be linked
using a VPN connection or direct connect, okay?
Now, we're going to have on-premises,
as well some DNS resolvers for,
obviously, the zone of our on-premises data center.
So they're going to be for the zone onpremise.private.
Now, when the server will issue
a DNS query for app.aws.private,
the DNS resolvers are going to say,
"Hey, you know what? I don't know these."
But what we're going to happen is that we're going to create
a resolver inbound endpoint.
And behind the scenes,
this resolver inbound endpoint has two ENIs,
again, for high availability.
Now these ENIs are associated with private IP addresses.
So what's going to happen is that
within our DNS resolvers on-premises,
we're going to say that for the domain name,
aws.private,
we're going to forward to these two IPS, okay?
And what's going to happen is that now,
the DNS query for app.aws.private
matches this domain name that was configured on-premises.
And therefore, the DNS resolver is going to say,
"Hey, I know I should forward these queries
to a DNS server that has this information."
So it's going to forward them to these IPs.
Now, the resolver inbound endpoint
is linked to the Route 53 Resolver.
And then from the private hosted zone,
we're going to get our final lookup
and give us the final information for this query.
So this is what's called an inbound endpoints
because requests coming from the exterior
and go inbound on AWS.
So on-premises to AWS.
As you may expect, the outbound endpoints are quite similar
but they go the other way.
So we have again the same setup, okay?
But this time, we want to be able to resolve
the DNS names of the on-premises data center.
So our EC2 instance is going to ask our Route 53 Resolver,
"Do you know about web.onprem.private?"
And for this, we're going to create a resolver
outbound endpoint which has two different ENIs.
And we're going to create a forwarding rule
which we're saying, "Hey,
for onprem.private,
here is the target IP.
And this target IP corresponds to the IP
of my DNS resolver on-premises."
So the Routes 53 Resolver
is going to send this to this endpoint.
And the endpoint is going to forward the DNS query
into the on-premises DNS resolver,
and then we will have automatically the response
from the records stored in the DNS
of our on-premises data center.
Now, to manage this outbound endpoint,
we need resolver rules.
So the outbound endpoint is going to set,
to have a set of rules, okay?
And it's going to explain how to forward
DNS queries on your network.
So there's conditional forwarding
which are the forwarding rules.
So the idea is that we're going to say,
"For specific DNS queries and this domain,
please match all of it to a target IP address."
So we can say, "For example.com
or acme.example.com,
here is the target IP
or here are the target IPs for these domains."
You can also override them with the system rule.
And this is to define overriding behavior,
which is saying, "Hey, for a whole sub domain,
do not use these forwarding rules."
This could be something you can create.
And then finally, we have auto-defined system rules
which is for domains that we know are resolved internally.
For example, domain names that are internal to AWS
or private hosted zones.
For example, compute.amazonaws.com or ec2.internal.
Now, in case of multiple rules matched,
the Route 53 Resolver is going to choose
the most specific match
in terms of how to choose which rule to apply.
Okay? So this is it.
This is how you have a Hybrid DNS on AWS.
Remember, inbound endpoints and outbound endpoints
usually are used together to have in and out traffic
from your both DNS systems from AWS and on-premises.
And the exam will ask you about them, for sure.
So that's it for this lecture. I hope you liked it.
And I will see you in the next lecture.