Examkin

Question

Difficulty: Very hardMulti-Account and Hybrid DNS Architecture Strategy

A biopharmaceutical company is migrating its clinical trial management platform to a multi-account AWS environment managed under AWS Organizations. The environment consists of a central Network Account (Account A) hosting a shared services VPC, and two separate application accounts (Account B and Account C) hosting production application VPCs. The shared services VPC is connected to the on-premises corporate network via AWS Transit Gateway and an AWS Direct Connect connection. The on-premises DNS domain is `corp.local`. The application accounts host Route 53 Private Hosted Zones (PHZs) for `clinical.aws` (Account B) and `trials.aws` (Account C). The company requires that all VPCs and the on-premises network can resolve all internal domains. DNS queries must remain private and highly available. Which TWO actions should a Solutions Architect take to implement this hybrid DNS resolution architecture? (Select TWO.)

  1. In Account A, deploy Route 53 Resolver inbound and outbound endpoints in the shared services VPC. Create an outbound resolver rule for the `corp.local` domain pointing to the on-premises DNS servers. Share the outbound resolver rule with Accounts B and C using AWS Resource Access Manager (RAM), and associate the rule with the shared services VPC and all application VPCs.Answer
  2. For the private hosted zones `clinical.aws` (Account B) and `trials.aws` (Account C), submit a cross-account VPC association authorization to the shared services VPC in Account A using the AWS CLI or Route 53 API. In Account A, accept the authorization and associate the shared services VPC with both private hosted zones. Associate each private hosted zone with the application VPCs in their respective accounts.Answer
  3. C
    Use AWS Resource Access Manager (RAM) to share the private hosted zones `clinical.aws` from Account B and `trials.aws` from Account C with the AWS Organization. In Account A, accept the resource share and associate the shared services VPC with the shared private hosted zones.
  4. D
    In Account A, deploy Route 53 Resolver outbound endpoints in the shared services VPC. Configure the outbound endpoints to route DNS queries to the on-premises DNS servers by creating a Direct Connect Gateway (DXGW) association directly with the outbound endpoints using a transit virtual interface.
  5. E
    In Account A, create Route 53 Resolver inbound rules for the domains `clinical.aws` and `trials.aws` pointing to the inbound endpoint IP addresses. Share these inbound rules with Accounts B and C using AWS Resource Access Manager (RAM) to enable resolution of the private hosted zones from the application VPCs.

Answer

Deploy Route 53 Resolver inbound and outbound endpoints in Account A, creating an outbound rule for `corp.local` that is shared via RAM. In parallel, perform a cross-account private hosted zone association for `clinical.aws` and `trials.aws` with the shared services VPC using the AWS CLI or Route 53 API.
To build a highly available, secure, and compliant hybrid DNS resolution architecture: 1) Deploying central Route 53 Resolver endpoints in Account A enables centralized ingress and egress of DNS traffic. The outbound resolver rule for `corp.local` is shared via AWS RAM, allowing application VPCs to forward queries through the central outbound endpoint. 2) For inbound queries from on-premises to resolve `clinical.aws` and `trials.aws`, the central inbound endpoint in Account A must have access to these zones. This is achieved by creating a cross-account VPC association authorization using the Route 53 API/CLI (since RAM is not supported for PHZs) to associate the shared services VPC in Account A with the PHZs in Accounts B and C.

Step-by-Step Solution

1
Deploy Route 53 Resolver endpoints in the hub VPC (Account A) to enable hybrid DNS resolution.
Inbound and outbound resolver endpoints are provisioned in the shared services VPC, using subnets in multiple Availability Zones for high availability.
Centralizing endpoints simplifies governance, reduces cost, and leverages the existing hybrid network connectivity (Transit Gateway/Direct Connect).
2
Configure outbound forwarding for the on-premises domain `corp.local`.
An outbound resolver rule for `corp.local` pointing to the on-premises DNS servers is created, shared via AWS RAM with Accounts B and C, and associated with all VPCs.
This allows resources in both the shared services VPC and application VPCs to forward queries for `corp.local` to the central outbound endpoints, which send them to the on-premises DNS servers.
3
Associate cross-account Private Hosted Zones with the central shared services VPC.
The owners of the PHZs (`clinical.aws` in Account B and `trials.aws` in Account C) authorize association with the shared services VPC in Account A using the AWS CLI or Route 53 API, which is then accepted in Account A.
The central inbound resolver endpoint in Account A can only resolve PHZs that are associated with its VPC. Because PHZs cannot be shared via RAM, this CLI/API-based authorization and association workflow is required.
4
Configure on-premises DNS forwarders.
On-premises DNS servers are configured with conditional forwarding rules for `clinical.aws` and `trials.aws` pointing to the IP addresses of the inbound resolver endpoints in Account A.
This routes on-premises DNS requests for AWS private zones to the inbound endpoints, which can now resolve them because the zones are associated with the shared services VPC.

Key Concept

Centralized Hybrid DNS with Route 53 Resolver Endpoints and Cross-Account Private Hosted Zone Associations
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic