Amazon Directory Service and OpenDNS

Iam not sure why using AWS AD DS would have any effect on using OpenDNS for your Users. Where are your users devices located?

The AWS-native way of controlling DNS queries would be with Route 53 Resolver. You wouldn't need your own DNS software or licensed products from Cisco. What sorts of issues did you encounter with it?

When the DNS queries are coming from an EC2 instance, you would set the EC2 instance to use 169.254.169.253 as its DNS server. That causes all queries to go to Route 53 Resolver. If some of the queries that Route 53 Resolver receives should go to another internal destination, such as AD domain controllers or on-premises servers, you can configure a Route 53 Resolver outbound endpoint through which the requests can be sent out and Route 53 Resolver rules that specify which queries should be sent where. There's a conceptual diagram on this documentation page: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

If you want to provide internal DNS zones to your users without using servers either for regular zones or for DNS "sinkholing", you can create a Route 53 private hosted zone for each domain and associate it with the same VPC where the endpoints are. Outbound endpoints or resolver rules aren't needed for these direct hosted zone associations.

When you enable Route 53 Resolver Firewall, it'll validate all the queries that Route 53 Resolver receives. It provides a set of AWS-managed, continuously updated domain lists that you can use to identify and filter queries for addresses known to be related to malware, botnets, and other threats. The available managed lists are described here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-managed-domain-lists.html. You can also configure your own domain lists to use in Route 53 Resolver Firewall rules.

You can enable query logging for Route 53 Resolver to see both all the queries and replies that Resolver processes, as well as to obtain details on which Resolver Firewall domain list each filtered query hit: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs.html

If you enable Route 53 Resolver Firewall, then in addition to the queries and answers being logged and being able to be ingested into a SIEM system, you can catch events from Resolver Firewall via EventBridge: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-firewall-eventbridge-integration.html

Try to use Cisco Umbrella https://umbrella.cisco.com/

https://aws.amazon.com/marketplace/pp/prodview-qmq75bsvag6qq

You have 2 options to use OpenDns

1. Create a DHCP Scope of the VPC to set the DNS Server to that of the OpenDNS Server IP addresses. Use a NAT Gateway so that you know your public source IP Address so that you can set rules on the OpenDNS Side.
2. Again using a NAT Gateway, create a Route53 Outbound Resolver on a private subnet with a route to the NAT Gateway. Create a Resolver Rule in Route53 using . as the domain and forward to the Open DNS IP Address. This overrides the System Default forward rule. This means you still use the default DHCP Scope in the VPC but route53 forwards all requests to OpenDNS

https://docs.aws.amazon.com/vpc/latest/userguide/DHCPOptionSet.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-rules-managing.html