Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A retail corporation is designing a hybrid DNS infrastructure across its on-premises data centers and multiple AWS accounts. The network architecture uses an AWS Transit Gateway to interconnect all VPCs. In the Network Services account, the team has configured a Route 53 Private Hosted Zone (PHZ) named `retail.internal` and associated it with a Hub VPC. The Hub VPC contains a Route 53 Resolver Inbound Endpoint. The team wants to ensure that all spoke VPCs in different member accounts and the on-premises servers can resolve DNS queries for `retail.internal`. Which of the following is the most operationally efficient method to satisfy these resolution requirements?

  1. Associate the spoke VPCs with the `retail.internal` Private Hosted Zone by submitting cross-account association authorizations from the Network Services account and then associating the spoke VPCs from the member accounts. Configure the on-premises DNS servers to forward queries for `retail.internal` to the Route 53 Resolver Inbound Endpoint IPs in the Hub VPC.Answer
  2. B
    Create a Route 53 Resolver Outbound Endpoint in each spoke VPC, and use AWS Resource Access Manager (RAM) to share the `retail.internal` Private Hosted Zone directly with all spoke VPCs in the AWS Organization.
  3. C
    Configure Route 53 Resolver Rules in each spoke VPC to forward queries for `retail.internal` to the Transit Gateway, and use a Direct Connect Gateway to route all DNS traffic directly to the on-premises DNS servers.
  4. D
    Share the Route 53 Resolver Inbound Endpoint with the entire AWS Organization using AWS Resource Access Manager (RAM), and configure the spoke VPCs' DHCP options sets to use the IP addresses of the Inbound Endpoint as their primary DNS servers.

Answer

Associate the spoke VPCs with the private hosted zone using cross-account association authorizations, and configure on-premises DNS servers to forward queries to the Route 53 Resolver Inbound Endpoint IPs.
The correct method involves establishing cross-account Private Hosted Zone associations for the spoke VPCs, which allows them to resolve the hosted zone directly. For hybrid resolution from on-premises, using a Route 53 Resolver Inbound Endpoint in the Hub VPC and configuring conditional forwarding on the on-premises DNS servers is the standard and most efficient pattern.

Step-by-Step Solution

1
Authorize the association of the Private Hosted Zone with the spoke VPCs.
The Network Services account submits an authorization request to associate the `retail.internal` PHZ with each spoke VPC ID in the other AWS accounts.
By default, Route 53 Private Hosted Zones cannot be associated with VPCs in other AWS accounts without explicit owner authorization.
2
Associate the spoke VPCs with the Private Hosted Zone.
The member accounts accept the authorization and associate their spoke VPCs with the `retail.internal` PHZ.
This allows EC2 instances and resources inside the spoke VPCs to resolve records in `retail.internal` directly via the Route 53 Resolver at the reserve VPC network address.
3
Configure forwarding on-premises.
On-premises DNS servers are configured with a conditional forwarder for `retail.internal` pointing to the IP addresses of the Inbound Resolver Endpoint in the Hub VPC.
This allows on-premises clients to traverse the hybrid connectivity (such as Direct Connect or VPN) to query the Hub VPC's resolver, which can resolve the PHZ.

Key Concept

Cross-account Private Hosted Zone association and hybrid DNS resolution using Route 53 Resolver Inbound Endpoints.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic