A multinational financial corporation has established a multi-account AWS environment usin… — AWS Certified Solutions Architect - Professional

A multinational financial corporation has established a multi-account AWS environment using AWS Organizations. A Shared Services account contains a central VPC ( $vpc-shared$ , CIDR $10.100.0.0/16$ ) and hosts a Route 53 Private Hosted Zone (PHZ) for the domain $corp.internal$ . A Production account contains a core workload VPC ( $vpc-prod$ , CIDR $10.200.0.0/16$ ). Both VPCs are interconnected via an AWS Transit Gateway. The on-premises corporate network is connected to the Transit Gateway using AWS Direct Connect with a Transit VIF and utilizes local DNS servers at $192.168.10.10$ and $192.168.10.11$ for the domain $onprem.internal$ .

The company requires name resolution between $vpc-prod$ and $onprem.internal$ , and also requires that resources in both $vpc-prod$ and on-premises resolve records in $corp.internal$ . The solution must minimize costs and administrative overhead by avoiding redundant endpoints.

Which design strategy should a solutions architect implement to meet these requirements?

A
Share the Private Hosted Zone for the corporate domain with the Production account using AWS Resource Access Manager (RAM). In the Production account, associate the shared hosted zone with the production VPC. Create Route 53 Resolver outbound endpoints in the production VPC and a forwarding rule for the on-premises domain pointing to the on-premises DNS servers. Create inbound endpoints in the shared services VPC and configure on-premises forwarders for the corporate domain to target the inbound endpoint IP addresses.
B
Create Route 53 Resolver inbound and outbound endpoints in both the shared services VPC and the production VPC. In each account, create a Route 53 Resolver forwarding rule for the on-premises domain pointing to the on-premises DNS servers. Do not associate the Private Hosted Zone with the production VPC; instead, configure a forwarding rule in the Production account for the corporate domain pointing to the inbound endpoints of the shared services VPC.
In the Shared Services account, authorize the association of the private hosted zone with the production VPC. In the Production account, associate the production VPC with the private hosted zone. Create Route 53 Resolver inbound and outbound endpoints in the shared services VPC. In the Shared Services account, create a Resolver forwarding rule for the on-premises domain pointing to the on-premises DNS servers, share this rule with the Production account via AWS Resource Access Manager (RAM), and associate it with the production VPC. Configure the on-premises DNS servers to forward queries for the corporate domain to the inbound endpoint IP addresses.Answer
D
In the Shared Services account, authorize the association of the private hosted zone with the production VPC. In the Production account, associate the production VPC with the private hosted zone. Create Route 53 Resolver outbound endpoints in the shared services VPC, and create a forwarding rule for the on-premises domain pointing to the on-premises DNS servers. Share this rule with the Production account via AWS Resource Access Manager (RAM). Configure the on-premises DNS servers to forward queries for the corporate domain to the Route 53 Resolver IP address of the shared services VPC via the Transit Gateway.

Answer

The correct strategy is to authorize the association of the Private Hosted Zone with the production VPC cross-account, associate them, centralize Route 53 Resolver inbound and outbound endpoints in the shared services VPC, create a forwarding rule for the on-premises domain and share it using AWS Resource Access Manager (RAM), and forward on-premises queries to the inbound endpoints.

The correct strategy leverages the cross-account VPC association API to link the Private Hosted Zone (PHZ) in the Shared Services account to the production VPC, ensuring local resolution. It optimizes cost by centralizing Route 53 Resolver endpoints in the shared services VPC, using AWS RAM to share the outbound resolver rules with the Production account. Lastly, it resolves the reachability constraint from on-premises by utilizing Route 53 Resolver inbound endpoints to accept queries from the corporate network over the Direct Connect transit connection.

Step-by-Step Solution

Authorize the association of the Route 53 Private Hosted Zone (PHZ) in the Shared Services account with the VPC in the Production account using the Route 53 API (create-vpc-association-authorization).

The Production account VPC is authorized to associate with the PHZ.

Route 53 Private Hosted Zones cannot be shared using AWS Resource Access Manager (RAM); cross-account association is the required mechanism to allow the production VPC to resolve the corporate domain locally without extra network hops.

Associate the production VPC with the Private Hosted Zone from the Production account using the Route 53 API (associate-vpc-with-hosted-zone).

Resources inside the production VPC can now resolve the corporate domain directly.

This establishes the logical link between the production VPC and the private DNS records hosted in the Shared Services account.

Deploy Route 53 Resolver outbound endpoints in the shared services VPC, create a forwarding rule for the on-premises domain pointing to the on-premises DNS servers, and share the rule with the Production account using AWS Resource Access Manager (RAM).

The production VPC can resolve on-premises domains using the shared rule.

Centralizing outbound endpoints in the shared services VPC and sharing rules via RAM avoids deploying duplicate outbound endpoints in the Production account, minimizing operational complexity and hourly endpoint charges.

Deploy Route 53 Resolver inbound endpoints in the shared services VPC and configure the on-premises DNS forwarders to target these inbound endpoint IP addresses for the corporate domain.

On-premises resources can resolve the corporate domain records.

The default Route 53 Resolver IP address (the default gateway IP plus two) only accepts queries originating within the local VPC. To resolve names from on-premises over Direct Connect, queries must be directed to an inbound endpoint.

Key Concept

Multi-Account and Hybrid Route 53 Resolver Architecture

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic