A company has hybrid connectivity between VPCs and its on-premises datacenter. The on-premises DNS server hosts the on-premises.example.com subdomain. The AWS workloads use aws.example.com across multiple VPCs and accounts. Resources in both locations can reach each other by IP, but the company wants workloads in the VPCs to resolve on-premises resources by their on-premises.example.com names. Which approach provides this with the MINIMUM operational overhead?

The correct approach uses a Route 53 Resolver outbound endpoint to forward DNS queries from VPCs to the on-premises DNS server. A Resolver rule is configured to conditionally forward queries for on-premises.example.com to the on-premises DNS server, and this rule is associated with the relevant VPCs. This is the AWS-native solution for hybrid DNS resolution, offering high availability and minimal operational overhead compared to managing EC2 instances. Creating both inbound and outbound endpoints is unnecessary; an inbound endpoint is for on-premises to AWS DNS resolution, which is not the primary requirement here. Using EC2 instances with BIND introduces significant operational overhead for patching, scaling, and high availability, and is not the recommended AWS-native solution for this use case. Launching an EC2 instance in each VPC further increases this overhead.