Conquering Hybrid DNS with Route 53 Resolver
summary
Concrete claim: Route 53 Resolver replaces DIY EC2 DNS boxes for hybrid clouds and is a regional VPC resource announced in 2018 (six years ago). The implementation uses inbound and outbound endpoints as ENIs in each AZ, security groups allowing TCP/UDP 53, VPC associations for private hosted zones, and RAM to share the resolver across spoke accounts. The stack integrates with GuardDuty and DNS Firewall for threat detection and filtering, and now supports Route 53 profiles to bundle zone associations and rules for reuse.
AI-written summary · about
chapters (10)
- 0:00intro
- 0:14welcome and agenda overview
- 1:32the problem before route 53 resolver
- 2:59introduction to route 53 resolver
- 3:37resolver endpoints explained
- 4:59security considerations for resolver endpoints
- 6:58design and implementation of hybrid dns
- 10:09security tools for dns setup
- 11:51new capability: route 53 profiles
- 12:31conclusion and final thoughts
related talks
17mStrengthening security with DNS Firewall
34mUsing DNS as a layer of defense
39mOutbound security implementation with AWS Network Firewall & Route 53
30mOptimizing the end user experience & security with AWS edge networking
09mDNS is the entry point for every application on the internet
51mNetwork inspection design patterns that scale
02h 04mProtective DNS – Why It Matters and How to Deploy It On-prem
26mIt Is Always DNS… Even at the Edge: Taming Proxy-Only Lookups With Cilium and eBPF