Sync Lambda

After BIND holds the new record, run the mirror from your laptop (not inside SSM):

aws --profile bind-demo-workload lambda invoke \
  --function-name "$(terraform -chdir=infra/terraform/workload output -raw sync_lambda_name)" \
  --cli-binary-format raw-in-base64-out \
  --payload '{"Domain":"corp.internal","MasterDns":"'"$(terraform -chdir=infra/terraform/workload output -raw bind_private_ip)"'","ZoneId":"'"$(terraform -chdir=infra/terraform/workload output -raw route53_zone_id)"'","IgnoreTTL":true}' \
  /tmp/sync-out.json && cat /tmp/sync-out.json

Pass: JSON like:

{
  "status": "success",
  "creates": 1,
  "upserts": 0,
  "deletes": 0,
  "duration_ms": 9982,
  "axfr_count": 8,
  "message": "Zone synchronized"
}

(creates / upserts / axfr_count depend on what you changed; a no-op re-sync shows zeros.)

Optional CloudWatch check:

aws --profile bind-demo-workload logs filter-log-events \
  --log-group-name "/aws/lambda/$(terraform -chdir=infra/terraform/workload output -raw sync_lambda_name)" \
  --filter-pattern "axfr_complete" \
  --limit 3

Or wait for EventBridge (default every 15 minutes) instead of invoking manually.