So, I have two AWS-based environments that are largely separated, but are connected via an intermediary VPC that hosts a VPN server, and has routing into each of the individual environments. Let's call these "A", "B" and "Management" VPCs.
"A" and "B" each have an Active Directory (a Microsoft Directory in AWS Directory Services), and the VPN is configured to use "A" to resolve DNS. Now, I want to bring "B" into DNS scope, so connecting users don't need to use IP addresses to connect to "B"'s servers.
To that end I set up the routes in my VPCs to allow the DCs to talk to each other, and confirmed at a network level that everything is open. Then, I set up a conditional forwarder in "A" to forward requests to "B" for its suffix.
(Note: I have, obviously, redacted all the actual names. Not for privacy, but to avoid confusion, since they are very similar)
However, when I try and query a "B" from an "A" server, it doesn't work. If I manually specify "B"'s DNS, however, it does work. Am I missing something important here?
Best Answer
I managed to get this to work, though it was a real trial.
First and foremost, it's important to remember that AWS Directory Services controllers are in a separate security group that, by default, restricts all outbound access except to other domain controllers. In order for my situation to work, I needed to explicitly add outbound access to the other domain controllers.
However, even when I did that, it still wasn't working. I had to delete the forwarder and re-create it after fixing the security group in order for it to work.