Stand up the lab
Simulated on-prem BIND
Authoritative DNS server for corp.internal in the simulated on-prem account. plus a cloud VPC with
Lambda and a Route 53 private hosted zone.
BIND to Route 53 Mirror Walkthrough
Legacy BIND has to stay on-prem — mirror it into Route 53 so cloud workloads can still use the same private DNS names.
What you’ll do
Section titled “What you’ll do”Change BIND
Edit corp.internal
Demo private zone name (`corp.internal`). BIND is authoritative; Route 53 holds a read-only mirror in the workload VPC. on the legacy
master, reload, and prove BIND still answers first.
Mirror and resolve
Run Sync_Lambda
Lambda in Workload_VPC that AXFRs from BIND_EC2, diffs against the Route 53 PHZ, and applies ChangeResourceRecordSets batches., then dig from the
cloud VPC via AmazonProvidedDNS — no direct BIND queries from workloads.
See the topology
BIND stays authoritative; Route 53 is a read-only mirror for cloud DNS.