Skip to content
BIND to Route 53 Mirror Walkthrough

Resolve in VPC

This step is the point of the demo: cloud DNS uses the Route 53 mirror. Echo the dig before starting SSM (env does not carry into the session):

Terminal window
echo 'dig walk.corp.internal A +short'
aws --profile bind-demo-workload ssm start-session \
  --target "$(terraform -chdir=infra/terraform/workload output -raw test_instance_id)"

On the test instance:

Terminal window
dig walk.corp.internal A +short
# Expected: 10.0.1.77


dig walk.corp.internal A +short @169.254.169.253
# Same answer via AmazonProvidedDNS → Route 53 PHZ

That path is AmazonProvidedDNS
VPC resolver at the base of the VPC CIDR + 2 (also reachable as 169.254.169.253) — Test_Instance queries this to hit the Route 53 mirror. → Route 53 PHZ
Route 53 private hosted zone for corp.internal associated with Workload_VPC only (not OnPrem_VPC). — the Test_Instance
EC2 in Workload_VPC used to validate resolution via AmazonProvidedDNS against the Route 53 mirror — never queries BIND directly. never queries BIND.

API check from your laptop (no SSM):

Terminal window
aws --profile bind-demo-workload route53 list-resource-record-sets \
  --hosted-zone-id "$(terraform -chdir=infra/terraform/workload output -raw route53_zone_id)" \
  --query "ResourceRecordSets[?Name=='walk.corp.internal.']" \
  --output table

Route 53 corp.internal records

Optional proofs

Section titled “Optional proofs”
ExtraHow
On-prem dig before syncDeploy with -var='enable_onprem_test_instance=true', dig @<bind_private_ip> from that host
AXFR ACLFrom test instance: dig @<bind_private_ip> corp.internal AXFR → transfer failed; only Lambda subnet 10.1.1.0/24 is allowed
Fail sync on purposeBreak reachability to BIND (e.g. stop lab VPN appliance); invoke Lambda → sync_error