AWS Networking: Hostname resolution options

Hostname resolution options for AWS.

Securely connect Astro to resources running in other VPCs or on-premises through a resolving service.

Using Route 53 requires sharing a resolver rule with your Astro account. If this is a security concern, Astronomer recommends using Domain Name System (DNS) forwarding.If you have a small number of records and immutable IP addresses, the Astronomer support team can create a Private zone with DNS records, pointed to your resources.

Shared resolver rule

Use Route 53 Resolver rules to allow Astro to resolve DNS queries for resources running in other VPCs or on-premises.

Prerequisites

• An Amazon Route 53 Resolver rule. See Managing forwarding rules.
• Permission to share resources using the AWS Resource Access Manager (RAM)

1. Share the Amazon Route 53 Resolver rule

   To allow Astro to access a private hosted zone, you need to share your Amazon Route 53 Resolver rule with your Astro AWS account.

   1. In the Route 53 Dashboard, click Rules below Resolver in the navigation menu.

   2. Select a Resolver rule and then click Details.

   3. Click Share and enter Astro in the Name field.

   4. In the Resources - optional section, select Resolver Rules in the Select resource type list and then select one or more rules.

   5. On the Associate permissions page, accept the default settings and then click Next.

   6. On the Grant access to principals page, select Allow sharing only within your organization, and then enter your Astro AWS account ID for your organization in the Enter an AWS account ID field.

      To get the Astro AWS account ID, in the Astro UI, click Organization Settings. From the General page, copy the AWS External ID.

   7. Click Create resource share.

2. To verify that the Amazon Route 53 Resolver rule was shared correctly, submit a request to Astronomer support. With your request, include the Amazon Route 53 Resolver rule ID. To locate the Resolver rule ID, open the Route 53 Dashboard, and in the left menu click Rules below Resolver. Copy the value in the Resolver ID column.

Domain Name System forwarding

Use Domain Name System (DNS) forwarding to allow Astro to resolve DNS queries for resources running in other VPCs or on-premises. Unlike Route 53, you don’t need to share sensitive configuration data with your Astro account. To learn more about DNS forwarding, see Forwarding outbound DNS queries to your network.

To use this solution, make sure Astro can connect to the DNS server using a VPC peering or transit gateway connection and then submit a request to Astronomer support. With your request, include the following information:

• The domain name for forwarding requests
• The IP address of the DNS server where requests are forwarded

Private hosted zone

Astronomer support can create Private hosted zones for reflecting particular DNS records in your environment without any changes or additional configurations. Private zones work well when the number of zones and records is small and stable. Otherwise, name resolution accuracy and connectivity in general can be affected.

To use this solution, submit a request to Astronomer support. With your request, include the following information:

• List of DNS records for the Private zone
• IP addresses that have to be assigned to each DNS record

(Optional) Create an Airflow connection to confirm connectivity

After Astronomer support confirms that DNS forwarding was successfully set up, you can confirm that it works by creating an Airflow connection to a resource running in a VPC or on-premises. See Managing Connections.