DNS names within VPN VPC

Question

We can connect to our AWS EC2 only from within the company VPN. I made a request to create DNS names for the servers. This would be made using AWS Route 53.

The operations team says that having a DNS name is a security risk and the explanation is "Names are easy to guess compared to IP addresses" "setting up a DNS for a sever in the public zone directly exposes the servers origin IP and opens up a potential to the DDOS attacks as well as subnet vulnerability"

The servers are not exposed outside our VPN. We have separate AWS accounts for different teams and public zone here refers to a different team.

Does the operations team have valid argument.

Answer 1

You should create a Route 53 Private Hosted Zone so the DNS name can't be resolved publicly.

You then need to configure the DNS server in the office to incorporate DNS responses from Route 53 by using a forwarder .

I don't know the full details, but here's some articles that should help:

• Resolving DNS Queries Between VPCs and Your Network - Amazon Route 53
• Resolve a Private Hosted Zone over VPN with Directory Service
• Use an Inbound Endpoint to Resolve Records in a Private Hosted Zone From a Remote Network