Route 53 DNS Service

1. Log in to the AWS console.
2. Create an inbound endpoint.

   1. Select ServicesRoute 53ResolverInbound Endpoints.
   2. Click Create inbound endpoint.
   3. Enter a descriptive Name.
   4. Select the VPC for the endpoint.
   5. Attach a security group for this endpoint.
   6. Set the Endpoint Type to IPv4.

   7. Select the availability zone.
   8. Select the subnet you created above.

      If you have more than one availability zone, you must specify the availability zone and subnet for each.

   9. Click Create inbound endpoint.
   10. Note the IP address associated with each subnet attached to your inbound endpoint. Use these IP addresses when configuring your DHCP option sets in the following steps.
3. Select VPCDHCP option sets.
4. You can create a new DHCP option set and add the IP address for each availability zone. If you have more than one availability zone, enter each IP address as a comma-separated list.

5. Select VPC and choose the VPC to secure.
6. From the Actions drop-down, select Edit VPC settings.
7. Under DHCP settings, choose the DHCP option set with you created above from the DHCP option set drop-down.

8. Click Save changes.

   The selected VPC now directs all DNS queries to the configured DNS server.
9. Edit your subnet route table.

   1. Select VPCRoute Tables.
   2. Select the route table for the subnet you want to secure.
   3. Add a route and set the destination to the IP address of your DNS server and set the target to the Cloud NGFW endpoint.

   4. Click Save changes.

      Any DNS traffic from the protected subnet is routed through the Cloud NGFW endpoint and on to the Cloud NGFW for inspection and enforcement.