Amazon Route 53 Resolver
Internal DNS for VPCs
The default DNS resolver of every VPC (the .2 address), with inbound/outbound endpoints and forwarding rules to resolve names back and forth between VPCs and on-prem networks. It also includes DNS Firewall to block queries to malicious domains.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA
Think of it asLike an internal switchboard that knows how to transfer calls to another branch's switchboard.
When to use it
✓ Use it when
Hybrid cloud that needs name resolution between VPCs and on-prem DNS.
✗ Avoid it when
You only need to manage public domains or private hosted zones → Route 53.
Common uses
- Outbound endpoint forwarding corp.local queries to on-prem DNS
- Inbound endpoint letting on-prem machines resolve private hosted zones
- DNS Firewall blocking malicious domains
What does it cost?
- Pricing model: The default resolver is free; endpoints are charged hourly per ENI plus the number of queries; DNS Firewall is charged per query and number of domains.
⚠️ Cost traps
Endpoints need at least 2 ENIs in 2 AZs, so there is always a fixed fee.
Related services
SAA-C03 study guide
Route 53 Resolver is covered in these study modules: