Skip to content
BIND to Route 53 Mirror Walkthrough

Prerequisites

Two AWS accounts

Section titled “Two AWS accounts”

The lab splits legacy BIND (simulated on-prem) from cloud workloads + Route 53 mirror.

ProfileRole
bind-demo-onpremSimulated on-prem
Simulated on-premises AWS account (CLI profile `bind-demo-onprem`) with BIND and the VPN appliance. — BIND master (+ lab VPN appliance)
bind-demo-workloadCloud workload
AWS workload account (CLI profile `bind-demo-workload`) with Lambda, Route 53 PHZ, VGW, and the dig test instance. — Sync Lambda, Route 53 PHZ, dig test instance

Override Terraform with -var='aws_profile=...' if your profile names differ.

Tools

Section titled “Tools”
  • AWS CLI v2 with Session Manager plugin
  • Terraform ≥ 1.5
  • Python 3.14 (local unit tests only; optional for the operator path)
  • Region: ap-southeast-2 (Sydney)

Clone the upstream demo

Section titled “Clone the upstream demo”
Terminal window
git clone https://github.com/jajera/bind-to-route53-mirror-demo.git
cd bind-to-route53-mirror-demo

All deploy and dig commands in this walkthrough run from that repo root.

Verify identities

Section titled “Verify identities”
Terminal window
export AWS_REGION=ap-southeast-2
aws --profile bind-demo-onprem sts get-caller-identity
aws --profile bind-demo-workload sts get-caller-identity

Confirm the two profiles resolve to different accounts.