Topology
What the diagram shows
Section titled “What the diagram shows”Left: simulated on-prem where legacy BIND
Authoritative DNS server for corp.internal in the simulated on-prem account. remains authoritative for corp.internal.
Right: cloud VPC where workloads resolve the same names from a Route 53 private hosted zone
Private hosted zone — Route 53 PHZ for corp.internal associated with Workload_VPC. after sync.
Hybrid reachability for zone transfer is drawn as Site-to-Site VPN in this lab. Treat that as how Sync_Lambda reaches BIND — not as the primary lesson.
Editable source: architecture.drawio · AWS Icons
| Side | Role |
|---|---|
| On-prem (OnPrem_VPC VPC simulating on-premises (`10.0.0.0/16`) — hosts BIND_EC2, optional OnPrem_Instance, and the VPN appliance.) | BIND_EC2 EC2 in OnPrem_VPC running BIND — hosts zone files, listens on TCP/UDP 53, and is the AXFR source for Sync_Lambda. (authority), optional on-prem dig client; VPN appliance only for lab reachability |
| Cloud (Workload_VPC VPC simulating AWS application land (`10.1.0.0/16`) — hosts VGW, Sync_Lambda, Test_Instance, and the Route 53 PHZ association.) | Sync_Lambda Lambda in Workload_VPC that AXFRs from BIND_EC2, diffs against the Route 53 PHZ, and applies ChangeResourceRecordSets batches., Route 53 PHZ corp.internal, Test_InstanceEC2 in Workload_VPC used to validate resolution via AmazonProvidedDNS against the Route 53 mirror — never queries BIND directly.; EventBridge schedule; NAT for Route 53 API |
Traffic paths
Section titled “Traffic paths”| Flow | Why it matters |
|---|---|
| Workload DNS | Test instance → AmazonProvidedDNS VPC resolver at the base of the VPC CIDR + 2 (also reachable as 169.254.169.253) — Test_Instance queries this to hit the Route 53 mirror. → Route 53 mirror (cloud day-to-day path) |
| AXFR Full DNS zone transfer over TCP/53 — Sync_Lambda pulls the entire zone from BIND across the VPN tunnel. | Sync_Lambda pulls full zone from BIND (lab path crosses VPN) |
| Route 53 API | Lambda → NAT → Route 53 HTTPS (mirror apply; not via VPN) |
Stack defaults
Section titled “Stack defaults”| Setting | Value |
|---|---|
| On-prem CIDR | 10.0.0.0/16 |
| Workload CIDR | 10.1.0.0/16 |
| Sync interval | 15 minutes Time between Sync_Lambda invocations (default 15 minutes). Bounds expected propagation delay together with Lambda runtime. |
| IgnoreTTL | true Lambda sync option that excludes TTL from the comparison key and forces consistent Route 53 TTLs when applying changes. |
| Region | ap-southeast-2 |
Explicit non-goals
Section titled “Explicit non-goals”- Migrating off BIND or making Route 53 authoritative for the enterprise zone
- Public delegation of
corp.internal - IXFR — full AXFR only
- Bi-directional sync (Route 53 → BIND)
- HA / multi-region for BIND or Lambda