Sync Pipeline

Steps

1. EventBridgeEventBridge
   Amazon EventBridge — schedules Sync_Lambda on a fixed interval (default every 15 minutes). invokes Lambda with Domain, MasterDnsMasterDns
   Lambda input: BIND private IP in OnPrem_VPC used as the AXFR target., ZoneId, IgnoreTTLIgnoreTTL
   Lambda sync option that excludes TTL from the comparison key and forces consistent Route 53 TTLs when applying changes..
2. AXFRAXFR
   Full DNS zone transfer over TCP/53 — Sync_Lambda pulls the entire zone from BIND across the VPN tunnel. full zone from the BIND master (authority stays on-prem).
3. List Route 53 records in the private hosted zoneprivate hosted zone
   Route 53 private hosted zone for corp.internal associated with Workload_VPC only (not OnPrem_VPC)..
4. Normalize into Record_SetRecord_Set
   Normalized DNS record (name, type, TTL, resource data) used when comparing AXFR output to Route 53.s, diff, apply Change_BatchChange_Batch
   Group of Route 53 ChangeResourceRecordSets operations submitted in one API call (≤1000 changes).es (≤1000 per call).
5. Structured logs to CloudWatchCloudWatch
   Amazon CloudWatch Logs — Sync_Lambda emits structured JSON events (`sync_start`, `axfr_complete`, `diff_summary`, `sync_success`, `sync_error`)..

graph TD
  EB[EventBridge schedule] --> L[Sync_Lambda]
  L --> AXFR[AXFR from BIND master]
  L --> R53[Route 53 API via NAT]
  AXFR --> DIFF[Normalize and diff]
  R53 --> DIFF
  DIFF --> APPLY[ChangeResourceRecordSets]
  APPLY --> CW[CloudWatch structured logs]

Log events (healthy run)

Event	Meaning
sync_start	Invocation began
axfr_complete	Zone transfer finished
diff_summary	Creates / upserts / deletes
apply_batch	Route 53 change batch submitted
sync_success	Mirror completed
sync_error	Fatal failure (stage: validation, axfr, r53_read, r53_write, …)