Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
Managing DNS conditional forwarders for your directory
A conditional forwarder is a DNS setting you configure in Active Directory to route queries
for a specific domain to a defined set of DNS servers. Conditional forwarders are required for
Active Directory trusts and are also used to support private DNS domains. Each conditional
forwarder consists of the fully qualified domain name (FQDN) of the remote domain and one or
more DNS server IP addresses.
On Amazon Managed Microsoft AD, a conditional forwarder is stored in Active Directory and replicated to
every domain controller in the domain (its replication scope is Domain). If your
directory uses Multi-Region
replication (available with the Enterprise Edition), the conditional forwarder is
also replicated automatically to every replicated Amazon Region. You create, update, or remove the
conditional forwarder once, from any Region. The change then propagates to all Regions through
native Active Directory replication.
You can run the following commands from
Amazon CloudShell, which comes with
the Amazon CLI and
Amazon Tools for PowerShell pre-installed. Amazon CloudShell automatically
configures your credentials.
-
Sign in to the Amazon Web Services Management Console.
-
Open Amazon CloudShell.
To use the PowerShell commands, run pwsh.
List conditional forwarders on your directory
You can list conditional forwarders on your directory by using the Amazon CLI or PowerShell:
- Amazon CLI
-
To list conditional forwarders on your directory
-
Run the following command, replacing the example value with your own:
aws ds describe-conditional-forwarders \
--directory-id d-123456abcd
For more information, see describe-conditional-forwarders in the Amazon CLI Command Reference.
- PowerShell
-
To list conditional forwarders on your directory
-
Run the following command, replacing the example value with your own:
Get-DSConditionalForwarder `
-DirectoryId d-123456abcd
For more information, see Get-DSConditionalForwarder in the Amazon Tools for PowerShell Cmdlet Reference.
Create a conditional forwarder for your directory
You can create a conditional forwarder for your directory by using the Amazon CLI or PowerShell:
- Amazon CLI
-
To create a conditional forwarder for your directory
-
Run the following command, replacing the example values with your own:
aws ds create-conditional-forwarder \
--directory-id d-123456abcd \
--remote-domain-name company.example.com \
--dns-ip-addrs 10.0.0.20 10.0.0.21
For more information, see create-conditional-forwarder in the Amazon CLI Command Reference.
- PowerShell
-
To create a conditional forwarder for your directory
-
Run the following command, replacing the example values with your own:
New-DSConditionalForwarder `
-DirectoryId d-123456abcd `
-RemoteDomainName company.example.com `
-DnsIpAddr 10.0.0.20,10.0.0.21
For more information, see New-DSConditionalForwarder in the Amazon Tools for PowerShell Cmdlet Reference.
Update a conditional forwarder on your directory
To update the DNS servers for an existing conditional forwarder, use the same remote domain
name with the new set of DNS server IP addresses. The new addresses overwrite the previous IP addresses.
You can update a conditional forwarder by using the Amazon CLI or PowerShell:
- Amazon CLI
-
To update a conditional forwarder on your directory
-
Run the following command, replacing the example values with your own:
aws ds update-conditional-forwarder \
--directory-id d-123456abcd \
--remote-domain-name company.example.com \
--dns-ip-addrs 10.2.0.20 10.2.0.21
For more information, see update-conditional-forwarder in the Amazon CLI Command Reference.
- PowerShell
-
To update a conditional forwarder on your directory
-
Run the following command, replacing the example values with your own:
Update-DSConditionalForwarder `
-DirectoryId d-123456abcd `
-RemoteDomainName company.example.com `
-DnsIpAddr 10.2.0.20,10.2.0.21
For more information, see Update-DSConditionalForwarder in the Amazon Tools for PowerShell Cmdlet Reference.
Remove a conditional forwarder from your directory
You can remove a conditional forwarder from your directory by using the Amazon CLI or PowerShell:
- Amazon CLI
-
To remove a conditional forwarder from your directory
-
Run the following command, replacing the example values with your own:
aws ds delete-conditional-forwarder \
--directory-id d-123456abcd \
--remote-domain-name company.example.com
For more information, see delete-conditional-forwarder in the Amazon CLI Command Reference.
- PowerShell
-
To remove a conditional forwarder from your directory
-
Run the following command, replacing the example values with your own:
Remove-DSConditionalForwarder `
-DirectoryId d-123456abcd `
-RemoteDomainName company.example.com
For more information, see Remove-DSConditionalForwarder in the Amazon Tools for PowerShell Cmdlet Reference.