Lecture 217: Route 53 Resolvers & Hybrid DNS
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:10
- 来源：Udemy Lecture 28556469
- Slide 数量：7
- 画面切换：01:05、02:16、04:25、05:18、05:48、06:22
扫描说明
逐条读取了 Udemy 页面中的 177 条英文 Transcript cue，并按时间轴扫描全长约 07:10 的视频。依据默认 Route 53 Resolver 能力、Inbound/Outbound Endpoint 总览、Inbound Flow、Outbound Flow、Forwarding Rule、System Rule、Most-specific Match 与 RAM 共享划分为 7 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 默认 Resolver 处理 AWS 名称；跨私有网络解析需要 Hybrid DNS
时间范围：00:00–01:05
总结 / Summary
中文
每个 VPC 的 Route 53 Resolver 默认能解析 EC2 Local Domain Name、Private Hosted Zone Record，以及 Internet Public Name Server 中的 Record。若需要在 VPC 与其他 Private Network 之间相互解析，例如 Peered VPC 或经 Direct Connect/VPN 连接的 On-premises Network，就要使用 Route 53 Resolver Endpoint 构建 Hybrid DNS。
English
The Route 53 Resolver in a VPC automatically resolves local EC2 names, records in private hosted zones, and records available from public name servers. Resolving names between the VPC and another private network, such as a peered VPC or an on-premises network connected by Direct Connect or VPN, requires Route 53 Resolver endpoints for hybrid DNS.
Transcript
00:00 Okay, so now let's view an advanced use case
00:02 that comes up a lot in the exam, which is around Hybrid DNS.
00:05 So we have our region and there is the Route 53 resolver.
00:09 And by default, this resolver is going
00:11 to automatically answer DNS queries
00:13 for local domain names for EC2 instances.
00:15 So for example, here's our VPC.
00:17 We have an EC2 instance.
00:18 There is this DNS name,
00:20 the Route 53 resolver knows how to reply to these queries.
00:23 So this is fine.
00:24 Any records in your private hosted zone as well
00:26 is going to be easy to answer to,
00:28 and records in public name servers,
00:29 for example, for a public hosted zone,
00:31 or any name server out there that is public on the internet.
00:35 Now, if you want to resolve DNS queries
00:37 between your VPC and other private networks,
00:40 your own networks that has other DNS resolvers,
00:43 then you're going to need a hybrid DNS.
00:46 So these networks can be PeeredVPC for example,
00:49 or it could be an on-premises network that is going
00:51 to be connected to our VPC
00:54 through Direct Connect or AWS VPN.
00:57 So for this, let me introduce you two concepts
00:59 that we're going to see with diagrams in the next slides.
01:02 So these are about resolver endpoints.
2. Inbound 接受外部 Query，Outbound 按条件把 AWS Query 转发出去
时间范围：01:05–02:16
总结 / Summary
中文
Inbound Endpoint 让外部 Network 的 DNS Resolver 把 Query 转给 Route 53，从而解析 AWS Resource 与 Private Hosted Zone。Outbound Endpoint 让 Route 53 按 Resolver Rule 把指定 Domain 的 Query 转给外部 DNS Resolver。Endpoint 可关联同 Region 的一个或多个 VPC，并至少跨两个 AZ 建 IP/ENI 以获得高可用；每个 IP 大约支持 10,000 QPS，可通过增加 IP 扩容。
English
An inbound endpoint lets DNS resolvers on external networks forward queries to Route 53 for AWS resources and private hosted zones. An outbound endpoint lets Route 53 conditionally forward selected domains to external resolvers through resolver rules. Endpoints can serve one or more VPCs in the same Region and use IPs or ENIs in at least two Availability Zones for high availability. Each IP supports roughly 10,000 queries per second, and more IPs add capacity.
Transcript
01:05 So there is two things.
01:06 There's an inbound endpoint and an outbound endpoint.
01:08 So inbound endpoints are allowing DNS resolvers
01:11 on your external networks to forward DNS queries
01:15 to your Route 53 resolver and answer these queries.
01:19 So these resolvers will help to resolve domain names
01:22 for the resources of AWS.
01:24 For example, your EC2 instances or records
01:26 that you create in your Route 53 private hosted zone.
01:29 So you get both answers for your internal systems,
01:33 and also for AWS private host zones,
01:35 and I will show you a diagram,
01:36 it will make a lot more sense very, very soon.
01:39 Now, your outbound endpoint is
01:40 to conditionally forward DNS queries
01:43 to your on-premises DNS resolvers.
01:46 And for this, we're going to create resolver rules
01:48 to forward them.
01:50 Now we associate these endpoints with one or more VPCs
01:52 within the same region,
01:54 and we create in two availability zones
01:55 for high availability.
01:57 Now each endpoint supports
01:58 about 10,000 queries per second, per IP address.
02:00 And if you need more, well, you create more IP addresses.
02:03 And these resolvers remove the need from before
02:07 where people have to run their own DNS resolvers
02:10 on AWS and link them to their resolvers on premises.
02:13 Now, these are managed resolver endpoints by AWS.
3. Inbound Flow：On-premises Resolver 把 aws.private 转发到 Endpoint 私网 IP
时间范围：02:16–04:25
总结 / Summary
中文
示例中 AWS Private Hosted Zone 为 aws.private，EC2 名称是 app.aws.private；On-premises Zone 为 onpremise.private。网络先通过 VPN 或 Direct Connect 打通。Inbound Endpoint 在两个 Private Subnet 中各有 ENI/IP；On-premises Resolver 配置 Conditional Forwarder，把 aws.private Query 发往这两个 IP，Endpoint 再交给 Route 53 Resolver，从 Private Hosted Zone 取得答案。方向是 On-premises → AWS。
English
The example uses an AWS private hosted zone aws.private with app.aws.private and an on-premises zone onpremise.private. VPN or Direct Connect provides connectivity. The inbound endpoint has an ENI and private IP in each of two private subnets. The on-premises resolver conditionally forwards aws.private queries to those IPs, and the endpoint passes them to Route 53 Resolver for an answer from the private hosted zone. The direction is on premises to AWS.
Transcript
02:16 So let's have a look at a diagram,
02:17 it will make a lot more sense.
02:19 So let's take an example where we have an EC2 instance,
02:23 and lives in a VPC,
02:24 and we have a private hosted zone that we create,
02:26 for example, aws.private,
02:28 and we have also an on-premises data center
02:31 that has a server.
02:33 Now, if you look at the EC2 instance,
02:35 I gave it a CNAME of app.aws.private, okay?
02:39 This is a CNAME, which is linked maybe to its EC2 DNS,
02:44 or it could be an A record linked to its private IP.
02:47 It doesn't matter right?
02:48 Now what's happening is that the server
02:50 at web.onpremises.private wants to access this EC2 instance.
02:55 And so first, the on-premises data center and the AWS cloud
02:59 are going to be linked using a VPN connection,
03:01 or Direct Connect.
03:02 Okay?
03:03 Now we're going to have on-premises as well
03:05 as some DNS resolvers,
03:06 for obviously the zone of our on-premises data center.
03:10 So they're going to be for the zone onpremise.private.
03:13 Now, when the server will issue a DNS query
03:16 for app.aws.private
03:18 the DNS resolvers are going to say, hey, you know what?
03:21 I don't know these,
03:22 but what we're going to happen is that we're going
03:24 to create a resolver inbound endpoint,
03:26 and behind the scenes this resolver inbound endpoint
03:29 has two ENIs, again for high availability.
03:32 Now these ENIs are associated with private IP addresses.
03:35 So what's going to happen is that
03:36 within our DNS resolvers on premises,
03:39 we're going to say that for the domain name, aws.private,
03:43 we're going to forward to these two IPs.
03:46 Okay?
03:46 And what's going to happen is that now the DNS query
03:49 for app.aws.private matches this domain name
03:53 that was configured on-premises,
03:54 and therefore the DNS resolver is going to say,
03:56 hey, I know I should forward these queries
03:58 to a DNS server that has this information.
04:02 So it's going to forward them to these IPs.
04:04 Now the resolver inbound endpoint is linked
04:06 to the Route 53 resolver,
04:08 and then from the private hosted zone,
04:11 we're going to get our final lookup
04:13 and give us the final information for this query.
04:16 So this is what's called inbound endpoints
04:18 because requests coming from the exterior
04:20 and go inbound on AWS, so on-premises to AWS.
4. Outbound Flow：Route 53 根据 Rule 把 onprem.private 发往本地 Resolver
时间范围：04:25–05:18
总结 / Summary
中文
反方向中，EC2 查询 web.onprem.private。为 onprem.private 创建 Forwarding Rule，Target IP 填 On-premises DNS Resolver 地址 172.16.0.10，并绑定 Outbound Endpoint。Route 53 Resolver 命中规则后把 Query 送到 Endpoint 的 ENI，再经 VPN/DX 转到本地 Resolver，由其 DNS Record 返回答案。方向是 AWS → On-premises。
English
In the reverse direction, an EC2 instance queries web.onprem.private. Create a forwarding rule for onprem.private whose target is the on-premises resolver address 172.16.0.10 and associate it with the outbound endpoint. Route 53 Resolver matches the rule, sends the query through the endpoint ENIs and VPN or Direct Connect, and the on-premises resolver answers from its records. The direction is AWS to on premises.
Transcript
04:25 As you may expect, the outbound endpoints are quite similar,
04:28 but they go the other way.
04:29 So we have again, the same setup, okay?
04:31 But this time we want to be able to resolve the DNS names
04:36 of the on-premises data center.
04:38 So our EC2 instance is going to ask our Route 53 resolver,
04:42 Do you know about web.onprem.private?
04:45 And for this,
04:46 we're going to create a resolver outbound endpoint,
04:48 which has two different ENIs.
04:50 And we're going to create a forwarding rule,
04:52 which is saying, hey, for on-prem.private
04:55 here is the target IP, and this target IP corresponds
04:58 to the IP of my DNS resolver on-premises.
05:02 So the Route 53 resolver is going to send this
05:04 to this endpoint,
05:05 and the endpoint is going to forward the DNS query
05:07 into the on-premises DNS resolver.
05:10 And then we will have automatically the response
05:13 from the records stored in the DNS
05:16 of our on-premises data center.
5. Conditional Forwarding Rule 用 Domain Suffix 映射一个或多个 Target IP
时间范围：05:18–05:48
总结 / Summary
中文
Outbound Endpoint 由 Resolver Rule 控制。Conditional Forwarding Rule 指定 Domain Name 与 Target IP，例如把 example.com 或 acme.example.com 及其 Subdomain Query 转发给 172.16.0.10。Rule 的匹配对象是 DNS Namespace，不是单一 Host，因此规划时要明确哪些后缀应交给哪组外部 Resolver。
English
Resolver rules control an outbound endpoint. A conditional forwarding rule maps a domain name to one or more target IPs, for example forwarding queries for example.com or acme.example.com and their subdomains to 172.16.0.10. Rules match DNS namespaces rather than a single host, so domain suffix ownership must be planned carefully.
Transcript
05:18 Now to manage this outbound endpoint,
05:20 we need resolver rules.
05:21 So the outbound endpoint is going to set,
05:23 to have a set of rules, okay?
05:25 And it's going to explain how to forward DNS queries
05:28 on your network.
05:29 So there's conditional forwarding,
05:30 which are the forwarding rules.
05:32 So the idea is that we're going to say
05:34 for specific DNS queries in this domain,
05:37 please match all of it to a target IP address.
05:40 So you can say, for example.com or acme.example.com,
05:43 here is the target IP, or here are the target IPs
05:46 for these domains.
6. System Rule 可覆盖 Forwarding；Auto-defined Rule 保护 AWS 内部 Namespace
时间范围：05:48–06:22
总结 / Summary
中文
System Rule 可选择性覆盖更广的 Forwarding Rule，例如 example.com 整体外送，但让 acme.example.com 不使用该转发。Auto-defined System Rule 则确保 compute.amazonaws.com、ec2.internal、Private Hosted Zone 等 AWS 内部 Domain 采用正确的内建解析。多条 Rule 同时匹配时，Route 53 Resolver 选择最具体的 Domain Match。
English
A system rule can selectively override a broader forwarding rule, such as forwarding example.com generally while excluding acme.example.com. Auto-defined system rules preserve correct internal resolution for names such as compute.amazonaws.com, ec2.internal, and private hosted zones. When multiple rules match, Route 53 Resolver selects the most-specific domain match.
Transcript
05:48 You can also override them with a system rule.
05:51 And this is to define overriding behavior,
05:53 which is saying, hey, for a whole subdomain,
05:55 do not use these forwarding rules.
05:57 This could be something you can create.
05:58 And then finally we have auto-defined system rules,
06:01 which is for domains that we know are resolved internally.
06:04 For example, domain names that are internal
06:06 to AWS or private hosted zones, for example
06:09 compute.amazonaws.com or EC2.internal.
06:12 Now in case of multiple rules matched,
06:15 the Route 53 resolver is going to choose
06:17 the most specific match,
06:18 in terms of how to choose which rule to apply.
06:20 Okay?
7. Resolver Rule 可通过 AWS RAM 跨 Account 集中共享
时间范围：06:22–07:10
总结 / Summary
中文
Resolver Rule 能通过 AWS Resource Access Manager（RAM）共享给其他 Account，从 Dedicated Network Account 集中管理，并让多个 VPC 使用同一组 Domain → Target IP 策略。实际 Hybrid DNS 通常同时部署 Inbound 与 Outbound Endpoint，分别完成 On-premises 访问 AWS Name 和 AWS 访问 On-premises Name 的双向解析。
English
Resolver rules can be shared across accounts through AWS Resource Access Manager (RAM), centrally managed in a dedicated network account, and consumed by multiple VPCs using the same domain-to-target-IP policy. A practical hybrid DNS design usually deploys both inbound and outbound endpoints for bidirectional resolution between on-premises and AWS namespaces.
Transcript
06:22 Finally, these resolver rules can be shared across accounts.
06:26 If you're using AWS resource access manager or RAM.
06:29 That means that you can share them across multiple accounts.
06:32 That means that you can manage them centrally
06:34 in one dedicated account for these resolver rules.
06:38 And then you can send DNS queries
06:39 from multiple VPC to the target IP defined in the rules.
06:43 So there are a way to have a central management
06:47 of your resolver rules in the central accounts.
06:50 Okay?
06:51 So this is it.
06:52 This is how you have a hybrid DNS on AWS.
06:54 Remember inbound endpoints and outbound endpoints
06:57 usually are used together to have in and out traffic
07:00 from your both DNS systems from AWS and on-premises,
07:03 and the exam will ask you about them for sure.
07:06 So that's it for this lecture.
07:07 I hope you liked it.
07:08 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Route 53 Hybrid DNS 用 Inbound Endpoint 接受 On-premises 发往 AWS Private DNS 的 Query，用 Outbound Endpoint + Resolver Rule 把 AWS Query 转发到 On-premises DNS。Endpoint 跨 AZ 提供高可用，每 IP 约 10,000 QPS；Rule 按 Most-specific Match 选择，并可通过 AWS RAM 跨 Account 集中共享。
English
Route 53 hybrid DNS uses inbound endpoints for on-premises queries into AWS private DNS and outbound endpoints plus resolver rules for AWS queries to on-premises DNS. Endpoints span Availability Zones for resilience and provide about 10,000 QPS per IP. Resolver rules use most-specific matching and can be shared centrally across accounts through AWS RAM.
返回顶部 ↑