Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A global logistics company is migrating its supply chain management systems to AWS. The company is using AWS Organizations to manage a multi-account environment. A central Shared Services account contains a VPC connected to the on-premises corporate network via AWS Transit Gateway and AWS Direct Connect. The Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for corp.internal containing service endpoints. A Production account and a Development account each have a VPC connected to the Transit Gateway. The on-premises network uses the domain onprem.internal for its internal DNS. The solutions architect must design a hybrid DNS solution that allows EC2 instances in the Production and Development VPCs to resolve hosts in both corp.internal and onprem.internal, and on-premises client machines to resolve hosts in corp.internal. The architecture must minimize cost by avoiding redundant endpoints, and must scale as new VPCs are added to the organization. Which of the following strategies should the solutions architect implement to achieve these requirements?

  1. Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate the rule with the Shared Services, Production, and Development VPCs. Authorize the association of the corp.internal Private Hosted Zone with the Production and Development VPCs from the Shared Services account, and perform the associations from the Production and Development accounts.Answer
  2. B
    Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule and the corp.internal Private Hosted Zone with the AWS Organization using AWS Resource Access Manager (RAM), and associate both the rule and the hosted zone with all VPCs.
  3. C
    Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate it with all VPCs. In the Production and Development accounts, use the Route 53 console to associate the Production and Development VPCs directly with the corp.internal Private Hosted Zone hosted in the Shared Services account.
  4. D
    Configure Route 53 Resolver Inbound and Outbound Endpoints in all VPCs (Shared Services, Production, and Development). Create Resolver forwarding rules for onprem.internal in each account pointing to the on-premises DNS servers, routing the DNS queries over the Direct Connect Gateway's public IP address directly to bypass the Transit Gateway.

Answer

Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC for on-premises resolution, use Route 53 Resolver Outbound Endpoints in the Shared Services VPC with forwarding rules shared via AWS RAM for on-premises domains, and authorize and associate the corp.internal Private Hosted Zone directly with the Production and Development VPCs.
The correct strategy involves setting up Route 53 Resolver Inbound Endpoints in the Shared Services VPC so that on-premises DNS servers can forward queries for corp.internal. For outbound queries to on-premises DNS, a central Outbound Endpoint is created in the Shared Services VPC, and a forwarding rule for onprem.internal is shared across the organization via AWS Resource Access Manager (RAM). To allow the Production and Development VPCs to resolve corp.internal directly without routing through resolver endpoints, the Private Hosted Zone must be associated with those VPCs. This requires authorization from the Shared Services account and association from the target accounts.

Step-by-Step Solution

1
Set up Route 53 Resolver Inbound Endpoints in the Shared Services VPC and configure on-premises DNS servers to forward queries for corp.internal to the inbound endpoint IPs.
On-premises clients can now resolve corp.internal DNS records over the AWS Direct Connect connection.
This establishes inbound name resolution from the local data center to AWS.
2
Set up a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and create a forwarding rule for onprem.internal pointing to on-premises DNS servers. Share the rule with the AWS Organization via AWS Resource Access Manager (RAM).
The forwarding rule becomes available to all member accounts in the organization.
Sharing the rule via RAM allows other VPCs to utilize the Shared Services Outbound Endpoint without needing to provision their own, reducing costs.
3
Associate the shared forwarding rule with the Shared Services, Production, and Development VPCs.
EC2 instances in all three VPCs can now resolve onprem.internal resources.
VPC association is required for the Route 53 Resolver to evaluate and apply the rule to queries originating in those VPCs.
4
In the Shared Services account, authorize the association of the corp.internal Private Hosted Zone with the Production and Development VPCs using the AWS CLI or SDK. In the Production and Development accounts, associate the VPCs with the hosted zone.
The corp.internal Private Hosted Zone is associated with the Production and Development VPCs.
This allows instances in the Production and Development VPCs to resolve corp.internal directly using the local Route 53 Resolver, eliminating the need to query across accounts via resolver endpoints.

Key Concept

Multi-Account and Hybrid DNS Architecture Strategy using Route 53 Resolver and cross-account Private Hosted Zone association.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic