Deploying internal DNS zones for internet-facing load balancers

This article explains how to deploy internal DNS zones for internet-facing load balancers using Route 53, EventBridge, Lambda, and DynamoDB.

• Internet-facing load balancers only resolve to public IPs, causing issues with DNS-based firewall rules
• Solution uses Route 53 private hosted zones to provide internal IP resolution for load balancers
• CloudTrail events trigger EventBridge rules to capture load balancer lifecycle changes
• Lambda functions (r53-scavenger and r53-updater) manage DNS record creation, updates, and deletion
• DynamoDB table tracks load balancer to IP mappings across accounts
• Supports multi-account environments using AWS Organizations
• Enables DNS queries to resolve internet-facing load balancers to internal-only addresses

This solution simplifies internal firewall routing and split DNS scenarios by automatically maintaining internal DNS records for internet-facing load balancers across multi-account AWS environments.