A private intranet service will run on EC2 instances in a VPC that is connected to the on-premises network via a Site-to-Site VPN. The new service must resolve hostnames in the company.example DNS zone; that zone is hosted only on-premises and reachable only from the corporate network. What solution enables instances in the VPC to resolve company.example names so the service can integrate with existing on-premises services?

The correct solution involves using Route 53 Resolver outbound endpoints. Enabling DNS hostnames for the VPC ensures EC2 instances can use the VPC's DNS resolver. A Route 53 Resolver outbound endpoint allows DNS queries originating from the VPC to be forwarded to on-premises DNS servers. A Resolver rule then specifically directs queries for company.example to these on-premises servers, enabling successful resolution. Creating an empty private Route 53 hosted zone for company.example and delegating from on-premises would make Route 53 authoritative for that zone, which is not the goal; the on-premises servers are the source of truth. Creating an inbound endpoint and configuring on-premises DNS to forward to it is for on-premises resources resolving VPC resources, not the other way around. Using AWS Systems Manager to manage hosts files is a manual and unscalable approach for dynamic DNS resolution.