AWS directoryservice medium security documentation change
Summary
Restructured DNS documentation into two approaches. Added critical information about DNS resolver selection during Simple AD creation and its impact on Route 53 integration. Included new configuration method using Route 53 as primary DNS.
Security assessment
The change documents security-critical DNS resolver selection behavior that affects Route 53 private zone functionality. The warning about unreachable amazon.com leading to disabled Route 53 features addresses a potential misconfiguration that could impact DNS security. The new conditional forwarding instructions also relate to secure DNS architecture.
Diff
diff --git a/directoryservice/latest/admin-guide/simple_ad_dns.md b/directoryservice/latest/admin-guide/simple_ad_dns.md index 53931b866..61c119970 100644 --- a//directoryservice/latest/admin-guide/simple_ad_dns.md +++ b//directoryservice/latest/admin-guide/simple_ad_dns.md @@ -4,0 +5,2 @@ +Using Simple AD as Your Primary DNSUsing Route 53 as Your Primary DNS + @@ -7 +9,31 @@ -Simple AD forwards DNS requests to the IP address of the Amazon-provided DNS servers for your Amazon VPC. These DNS servers will resolve names configured in your Amazon Route 53 private hosted zones. By pointing your on-premises computers to your Simple AD, you can now resolve DNS requests to the private hosted zone. For more information on Route 53, see [What is Route 53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html). +You can configure DNS for Simple AD in two ways depending on your network architecture and requirements. + +## Using Simple AD as Your Primary DNS + +Configure your client computers to use the Simple AD DNS server IP addresses as their primary DNS resolvers. Simple AD forwards DNS requests to the IP address of the Amazon-provided DNS servers for your Amazon VPC. These DNS servers will resolve names configured in your Amazon Route 53 private hosted zones. By pointing your on-premises computers to your Simple AD, you can now resolve DNS requests to the private hosted zone. For more information on Route 53, see [What is Route 53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html). + +During Simple AD creation, the service performs a reachability test to amazon.com to determine which DNS resolver to use: + + * **Customer VPC DNS Resolver (ETH1)** – Selected when amazon.com is reachable from customer VPC resolver. This option enables Route 53 private hosted zones and Resolver firewall rules. + + * **Amazon Internal Resolver (ETH0)** – Selected when amazon.com is unreachable from customer VPC DNS Resolver (ETH1). Route 53 integration, private hosted zones, and Resolver firewall rules will not function with this option. + + + + +###### Important + +The DNS resolver selection occurs automatically during Simple AD creation and cannot be modified afterward. We recommend that you ensure amazon.com is resolvable in your VPC before creating Simple AD to enable Route 53 integration. + +## Using Route 53 as Your Primary DNS + +You can also use Route 53 as your primary DNS service: + + * Configure your client computers to use Route 53 Resolver IP addresses as their primary DNS resolvers + + * Create Route 53 Resolver rules to conditionally forward only your domain's fully qualified domain name (FQDN) queries to Simple AD + + * This approach maintains Route 53 as the authoritative DNS source, with Simple AD handling only domain-specific queries + + +