Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A financial services firm is migrating its transactional applications to a multi-account AWS environment managed under AWS Organizations. The architecture includes a central Network VPC in a Shared Services account and multiple application VPCs in separate production accounts. A Route 53 Private Hosted Zone (PHZ) named `corp.internal` is hosted in the Shared Services account. Network connectivity between the central Network VPC, production VPCs, and the on-premises datacenter is established using AWS Transit Gateway. On-premises DNS servers manage the `onprem.corp` domain. An outbound Route 53 Resolver endpoint is deployed in the Network VPC to forward queries for `onprem.corp` to the datacenter. Which combination of actions should a solutions architect recommend to enable DNS resolution of both `corp.internal` and `onprem.corp` from the production VPCs with the least administrative overhead?

  1. A
    Share the `corp.internal` PHZ with the production accounts using AWS Resource Access Manager (RAM). In the production VPCs, create Route 53 Resolver conditional forwarding rules for both `corp.internal` and `onprem.corp` that target the inbound Route 53 Resolver endpoint in the Network VPC.
  2. Associate the `corp.internal` PHZ with the production VPCs by submitting a cross-account association authorization from the Shared Services account and accepting it in the production accounts. Share the `onprem.corp` Route 53 Resolver rule from the Shared Services account to the production accounts using AWS Resource Access Manager (RAM), and associate the shared rule with the production VPCs.Answer
  3. C
    Associate the `corp.internal` PHZ with the production VPCs by creating duplicate copies of the private hosted zone in each production account. Configure the Transit Gateway to route all DNS traffic (UDP/TCP port 53) originating from the production VPCs directly to the on-premises DNS servers via AWS Direct Connect Gateway transit virtual interfaces.
  4. D
    Create Route 53 Resolver outbound endpoints in each production VPC. Configure conditional forwarding rules in the production accounts to send `corp.internal` and `onprem.corp` queries to the inbound Route 53 Resolver endpoint in the Network VPC without authorizing PHZ association.

Answer

Associate the `corp.internal` PHZ with the production VPCs by submitting a cross-account association authorization from the Shared Services account and accepting it in the production accounts. Share the `onprem.corp` Route 53 Resolver rule from the Shared Services account to the production accounts using AWS Resource Access Manager (RAM), and associate the shared rule with the production VPCs.
The correct configuration uses Route 53 cross-account Private Hosted Zone (PHZ) association to resolve `corp.internal` and Route 53 Resolver rules shared via AWS Resource Access Manager (RAM) to resolve `onprem.corp`. This architecture centralizes DNS outbound endpoints in the Shared Services Network VPC, significantly reducing costs and management overhead while avoiding the duplication of private hosted zones.

Step-by-Step Solution

1
Authorize cross-account association of the Private Hosted Zone.
The Shared Services account submits an authorization allowing the production VPCs to associate with the `corp.internal` private hosted zone.
By default, Route 53 Private Hosted Zones cannot be associated with VPCs in other accounts without explicit cross-account authorization.
2
Accept the association in the production accounts.
Each production account runs an association command via the AWS CLI or API to link their VPCs to the centralized `corp.internal` hosted zone.
This establishes private DNS resolution for `corp.internal` inside the production VPCs without duplicating records.
3
Share the Route 53 Resolver outbound rule via AWS RAM.
The forwarding rule for `onprem.corp` associated with the central outbound endpoint is shared with the AWS Organization's production accounts.
Sharing the rule allows spoke VPCs to use the central Network VPC's outbound resolver endpoint for forwarding on-premises DNS queries, eliminating the need to provision redundant outbound endpoints.
4
Associate the shared rule with production VPCs.
Each production account associates the shared Route 53 Resolver forwarding rule with their respective VPCs.
This automatically routes DNS requests for `onprem.corp` from the production VPCs to the central outbound endpoint and across Transit Gateway to the datacenter.

Key Concept

Multi-account Private Hosted Zone association combined with centralized hybrid Route 53 Resolver rule sharing via AWS RAM.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic