A company has a VPC with a Site-to-Site VPN to on premises and uses the default DHCP options set. An application on an Amazon Linux 2 EC2 instance must retrieve an RDS secret from Secrets Manager via a private VPC endpoint and must also call an internal on-premises REST API at https://api.example.internal. Two on-premises Windows DNS servers perform internal resolution. The EC2 instance can reach the on-premises API by IP address but not by the hostname. What should a network engineer do to fix this and prevent the issue for other VPC resources?

The correct solution is to create an Amazon Route 53 Resolver rule. This allows the VPC to forward DNS queries for the example.internal domain to the on-premises Windows DNS servers, enabling resolution of the internal API hostname. This is a scalable and centralized solution for all resources within the VPC. Creating a new DHCP options set is incorrect because AWS-provided DNS (the default) is required for resolving AWS service endpoints like Secrets Manager. Changing the DHCP options set to point to on-premises DNS would break resolution for AWS services. Editing the local hosts file or /etc/resolv.conf on the EC2 instance are temporary, instance-specific fixes that do not prevent the issue for other VPC resources, making them impractical for a network-wide solution.