> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Networking: Hostname resolution options

Securely connect Astro to resources running in other VPCs or on-premises through a resolving service.

Using Route 53 requires sharing a resolver rule with your Astro account. If this is a security concern, Astronomer recommends using Domain Name System (DNS) forwarding. If you have a small number of records and immutable IP addresses, the Astronomer support team can create a Private zone with DNS records, pointed to your resources.

<Tabs>
  <Tab title="Shared resolver rule">
    Use Route 53 Resolver rules to allow Astro to resolve DNS queries for resources running in other VPCs or on-premises.

    **Prerequisites**

    * An Amazon Route 53 Resolver rule. See [Managing forwarding rules](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-rules-managing.html).
    * Permission to share resources using the AWS Resource Access Manager (RAM)

    <Steps>
      <Step title="Share the Amazon Route 53 Resolver rule">
        To allow Astro to access a private hosted zone, you need to share your Amazon Route 53 Resolver rule with your Astro AWS account.

        1. In the Route 53 Dashboard, click **Rules** below **Resolver** in the navigation menu.

        2. Select a Resolver rule and then click **Details**.

        3. Click **Share** and enter `Astro` in the **Name** field.

        4. In the **Resources - optional** section, select **Resolver Rules**  in the **Select resource type** list and then select one or more rules.

        5. On the **Associate permissions** page, accept the default settings and then click **Next**.

        6. On the **Grant access to principals** page, select **Allow sharing only within your organization**, and then enter your Astro AWS account ID for your organization in the **Enter an AWS account ID** field.

           To get the Astro AWS account ID, In the Astro UI, click **Organization Settings**. From the **General** page, copy the **AWS External ID**.

        7. Click **Create resource share**.
      </Step>

      <Step Title="Contact Astronomer support for rule verification">
        To verify that the Amazon Route 53 Resolver rule was shared correctly, submit a request to [Astronomer support](https://cloud.astronomer.io/open-support-request). With your request, include the Amazon Route 53 Resolver rule ID. To locate the Resolver rule ID, open the Route 53 Dashboard, and in the left menu click **Rules** below **Resolver**. Copy the value in the Resolver **ID** column.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Domain Name System forwarding">
    Use Domain Name System (DNS) forwarding to allow Astro to resolve DNS queries for resources running in other VPCs or on-premises. Unlike Route 53, you don't need to share sensitive configuration data with your Astro account. To learn more about DNS forwarding, see [Forwarding outbound DNS queries to your network](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html).

    To use this solution, make sure Astro can connect to the DNS server using a VPC peering or transit gateway connection and then submit a request to [Astronomer support](https://cloud.astronomer.io/open-support-request). With your request, include the following information:

    * The domain name for forwarding requests
    * The IP address of the DNS server where requests are forwarded
  </Tab>

  <Tab title="Private hosted zone">
    Astronomer support can create Private hosted zones for reflecting particular DNS records in your environment without any changes or additional configurations. Private zones work well when the number of zones and records is small and stable. Otherwise, name resolution accuracy and connectivity in general can be affected.

    To use this solution, submit a request to [Astronomer support](https://cloud.astronomer.io/open-support-request). With your request, include the following information:

    * List of DNS records for the Private zone
    * IP addresses that have to be assigned to each DNS record
  </Tab>
</Tabs>

### (Optional) Create an Airflow connection to confirm connectivity

After Astronomer support confirms that DNS forwarding was successfully set up, you can confirm that it works by creating an Airflow connection to a resource running in a VPC or on-premises. See [Managing Connections](https://airflow.apache.org/docs/apache-airflow/stable/howto/connection.html).