A media streaming company manages a multi-account AWS environment connected to its on-premises data center via AWS Transit Gateway. The Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for `media.internal` associated with the Shared Services VPC. The company is deploying new application VPCs in separate member accounts. Resources in the application VPCs must resolve names in `media.internal` and also resolve domains hosted on-premises (`onprem.local`). How should a Solutions Architect design the DNS architecture to meet these requirements with the minimum administrative overhead?
- AShare the `media.internal` private hosted zone with the organization using AWS Resource Access Manager (RAM). Create a Route 53 Resolver outbound endpoint in the Shared Services VPC, configure a resolver rule for `onprem.local` pointing to the on-premises DNS servers, share this rule using RAM, and associate both the shared private hosted zone and the resolver rule with the application VPCs.
- BAuthorize the cross-account association of the `media.internal` private hosted zone with the application VPCs from the Shared Services account, and then associate the VPCs. Route DNS queries for `onprem.local` over a Direct Connect Gateway using a private virtual interface (VIF) and configure static DNS routes in the Transit Gateway route tables.
- Authorize the cross-account association of the `media.internal` private hosted zone with the application VPCs from the Shared Services account, and then associate the VPCs. Create a Route 53 Resolver outbound endpoint in the Shared Services VPC, configure a resolver rule for `onprem.local` pointing to the on-premises DNS servers, share this rule using AWS Resource Access Manager (RAM), and associate it with the application VPCs.Answer
- DRecreate the `media.internal` private hosted zone in each member account. Create a Route 53 Resolver outbound endpoint in each application VPC, configure a resolver rule for `onprem.local` pointing to the on-premises DNS servers, and establish direct VPC Peering connections between all application VPCs and the Shared Services VPC.
Answer
Authorize the cross-account association of the `media.internal` private hosted zone with the application VPCs from the Shared Services account, and then associate the VPCs. Create a Route 53 Resolver outbound endpoint in the Shared Services VPC, configure a resolver rule for `onprem.local` pointing to the on-premises DNS servers, share this rule using AWS Resource Access Manager (RAM), and associate it with the application VPCs.
The correct answer provides a hybrid DNS design that addresses both private hosted zone resolution and on-premises resolution with minimal endpoints. First, to allow cross-account VPCs to resolve the private hosted zone `media.internal`, cross-account association must be authorized from the owner account and then accepted from the consumer accounts. Second, a centralized Route 53 Resolver outbound endpoint is created in the Shared Services VPC. A forwarding rule for the on-premises domain is created, pointing to the on-premises DNS IPs. This forwarding rule is shared via AWS RAM with the other member accounts in the AWS Organization. Once associated with the application VPCs, resources in those VPCs can route their DNS queries through the centralized outbound endpoint, avoiding the cost and overhead of provisioning endpoints in every VPC.
Step-by-Step Solution
Key Concept
Centralized hybrid and multi-account DNS resolution using Route 53 Resolver endpoints, forwarding rules shared via RAM, and cross-account Private Hosted Zone association.
Estimated Time:2m 30s