---
title: "AWS - Destination"
canonical: "https://docs.infoblox.com/space/UniversalAssetInsights/1501135316/AWS%20-%20Destination"
format: markdown
---
> ⚠️ IPAM and DNS discoveries are not supported if you only have the Infoblox Threat Defense license entitlement.

In the **Destination** step of the **Create Discovery Job Configuration** wizard, configure the following:

- **DNS Discovery**: Toggle **Enabled** (green) or **Disabled **(blue). By default, DNS discovery is disabled. When enabled, all the DNS objects are discovered. If you do not want the DNS objects to be discovered, disable DNS discovery. You can configure the fields on this dialog only if DNS discovery is enabled.
  - **Sync Type**: The following options are available:
    - Read Only:
      - The periodic synchronization from the cloud provider takes place.
      - Users cannot write/update Zones and Records objects on the particular cloud provider through the Infoblox Portal
      - Permissions needed:
        - The AWS credential with Describe Regions or “[AmazonEC2ReadOnlyAccess](https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAmazonEC2ReadOnlyAccess)“.
    - Read Write:
      - Users can read and write from/to the cloud provider. Certain permissions are required for Read Write Sync. For more information, see *[Permissions required in AWS](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186680896)**.*
      - For more information, see *[Universal DDI Licensing](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/846954761)*.
  - **Access View**: Select the Access View from the drop-down. For more information, see *[Configuring Access Views](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/680362523)**.*
  - **Destination DNS View** - Select the DNS view from the drop-down. The discovered objects will be copied to the selected DNS view.
  - **Consolidate Public/Private Zone data into this DNS View**: Toggle **Enabled** (green) or **Disabled **(red). If you enable this option, public and private zone data will be copied into this view.
  - **Split View: **Toggle **Enabled** (green) or **Disabled **(blue). All private hosted zones are placed into a DNS view that is automatically created by the Universal DDI platform during synchronization. For more information, see *[Enabling Split View](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/444039264)*.
  - **Forward Only Zone**: Toggle **Enabled** (green) or **Disabled **(blue). This allows Zones to act as Forward Zones when configured on Universal DDI Service Instance as the Authoritative DNS Server. For more information, see *[Importing AWS Private Zones as Read/Write Forward Zones.](https://infoblox-docs.atlassian.net/wiki/pages/createpage.action?spaceKey=BloxOneDDI&title=Importing%20AWS%20Private%20NIOS-X%20Servered%20Zones%20as%20Read%2FWrite%20Forward%20Zones)*
  - **Cloud Forwarder Discovery**: Toggle **Enabled** (green) or **Disabled **(blue). If you enable this option, you can sync DNS resolver endpoints into a DNS view. If you enable **Consolidate Public/Private Zone data into this DNS View**, the DNS resolver endpoints are synced to the selected DNS view. Otherwise, the DNS resolver endpoints are synced to a separate view with the format `discovery_job_name.resolver-rules`. Before enabling cloud forwarder discovery, you must *[Create a Cloud Forwarder](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/684524240)*. The prerequisite permissions in AWS are listed in *[Permissions required in AWS](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186680896)**.*
- **IPAM Discovery:** Toggle **Enabled** or **Disabled**. When enabled, IP address information will be synchronized with IPAM. When disabled, IP address information will not be synchronized with IPAM.
- **Destination Federated Realm**: Choose the Federated Realm where the discovered IP address information will be synced.
- **Ingestion Rules**: Discovery automatically imports all DNS zones from the source. However, if you wish to synchronize only specific zones, you can configure the discovery process to include or exclude designated DNS zones. Wildcards can be utilized to specify the names of these zones. You may place a wildcard at the beginning, in the middle, or at the end of the zone name. Choose one of the following configuration options:
  - **Include**: Choose this option and click **Add**. Specify the exact name of the zone or using wildcard. The specified zone and the zones matching the criteria only are included.
  - **Exclude**: Choose this option and click **Add**. Specify the exact name of the zone or using wildcard. The specified zone and the zones matching the criteria only are excluded.

## Supported Patterns

The following patterns are supported:

| **Pattern** | **Description** |
| --- | --- |
| `*` | Matches all zones. Use for global inclusion or exclusion. |
| `*.com` | Matches any zone that ends with .com, such as <u>[example.com](http://example.com/)</u> , <u>[test.com](http://test.com/)</u>. |
| `example.*` | Matches zones that start with example., like <u>[example.net](http://example.net/)</u> , <u>[example.io](http://example.io/)</u>. |
| `*test*.com` | Matches any zone with “test” anywhere in the name, for example, <u>[mytestsite.com](http://mytestsite.com/)</u> . |
| `test?.com` | Matches <u>[test1.com](http://test1.com/)</u>, <u>[testA.com](http://testa.com/)</u> , <u>[testX.com](http://testx.com/)</u>, etc. (? matches one character). |
| `ns[1-3].example.com` | Matches <u>[ns1.example.com](http://ns1.example.com/)</u>, <u>[ns2.example.com](http://ns2.example.com/)</u>, and <u>[ns3.example.com](http://ns3.example.com/)</u>. |
| `{dev,test,prod}.example.com` | Matches any of the listed environments, for example, <u>[dev.example.com](http://dev.example.com/)</u>. |
| `*.{com,org,net}` | Matches zones ending in .com, .org, or .net. |
| `dev-*.example.com` | Matches zones with a dev- prefix, such as <u>[dev-stage.example.com](http://dev-stage.example.com/)</u>. |
| `[a-z].co.in` | Matches zones like <u>[a.co.in](http://a.co.in/)</u>, <u>[b.co.in](http://b.co.in/)</u>, etc. (single lowercase letter). |
| `*_*.example.com` | Matches zones with an underscore, for example, dev_env.example.com. |

Important points about wildcard patterns:

- Patterns are case-insensitive.
- Curly braces {} specify multiple options.
- Square brackets [] define character ranges.
- Asterisk * matches any number of characters.
- Question mark ? matches exactly one character.
- The following pattern with nested curly brackets is not supported:
  - `test-{dev-{1,2},prod}.com`

> ⚠️ IPAM Discovery is disabled by default. If you create a discovery job and do not enable this setting, no IP address information will be synchronized with IPAM. When IPAM Discovery is disabled after it was previously enabled, existing IP address information from previously synced assets will remain but new assets will not be synced to IPAM.