How can the Security Engineer block access to the Amazon-provided DNS in the VPC?
Deny access to the Amazon DNS IP within all security groups.
Add a rule to all network access control lists that deny access to the Amazon DNS IP.
Add a route to all route tables that black holes traffic to the Amazon DNS IP.
Disable DNS resolution within the VPC configuration.
Explanations:
Security groups control inbound and outbound traffic based on instance-level security, but they do not block specific DNS IP addresses directly. Therefore, this option is not effective for blocking Amazon-provided DNS.
Network Access Control Lists (NACLs) operate at the subnet level, but AWS DNS uses multiple IP ranges dynamically, making it impractical to block Amazon DNS by IP in NACLs. Additionally, blocking DNS IPs is not the recommended approach for this use case.
Adding a route to blackhole traffic for the Amazon DNS IPs is not the correct approach since Amazon DNS uses dynamic IP ranges. It’s also more complex than simply disabling DNS resolution in the VPC.
Disabling DNS resolution within the VPC configuration directly prevents Amazon EC2 instances from using the Amazon-provided DNS service. This is the most straightforward and correct method for achieving the objective.
I infer that the answer is:
Disable DNS resolution within the VPC configuration.