A corporate retail conglomerate is designing a hybrid DNS architecture across a multi-account AWS environment managed by AWS Organizations. The environment is connected to an on-premises network via AWS Transit Gateway. A central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for `shared.retail.internal`. The on-premises servers host the DNS zone `onprem.retail.internal`. Spoke VPCs in multiple member AWS accounts host individual application workloads and need to resolve both `shared.retail.internal` and `onprem.retail.internal`. Additionally, on-premises clients must be able to resolve `shared.retail.internal`. The company wants to minimize resource duplication, endpoint costs, and administrative overhead. Which combination of steps will meet these requirements?
- Create Route 53 Resolver inbound and outbound endpoints in the Shared Services VPC. In the Shared Services account, authorize the association of the `shared.retail.internal` PHZ with the spoke VPCs. In each member account, associate the spoke VPCs with the PHZ. In the Shared Services account, create a Route 53 Resolver outbound rule for `onprem.retail.internal` pointing to the on-premises DNS servers, share the rule with the organization using AWS Resource Access Manager (RAM), and associate the shared rule with each spoke VPC. Configure on-premises DNS forwarders to route queries for `shared.retail.internal` to the inbound Resolver endpoint IP addresses.Answer
- BCreate Route 53 Resolver inbound and outbound endpoints in the Shared Services VPC. Share the `shared.retail.internal` PHZ with the organization using AWS Resource Access Manager (RAM), and associate the hosted zone with the spoke VPCs in each member account. In the Shared Services account, create a Route 53 Resolver outbound rule for `onprem.retail.internal` pointing to the on-premises DNS servers, share the rule with the organization using AWS RAM, and associate the shared rule with each spoke VPC. Configure on-premises DNS forwarders to route queries for `shared.retail.internal` to the inbound Resolver endpoint IP addresses.
- CCreate a Route 53 Resolver outbound endpoint in the Shared Services VPC. In the Shared Services account, authorize the association of the `shared.retail.internal` PHZ with the spoke VPCs. In each member account, associate the spoke VPCs with the PHZ. In the Shared Services account, create a Route 53 Resolver outbound rule for `onprem.retail.internal` pointing to the on-premises DNS servers, share the rule with the organization using AWS Resource Access Manager (RAM), and associate the shared rule with each spoke VPC. Configure on-premises DNS forwarders to route queries for `shared.retail.internal` to the Route 53 Resolver system IP address () via the Transit Gateway.
- DCreate Route 53 Resolver inbound and outbound endpoints in the Shared Services VPC. In the Shared Services account, authorize the association of the `shared.retail.internal` PHZ with the spoke VPCs. In each member account, associate the spoke VPCs with the PHZ. In the Shared Services account, create a Route 53 Resolver outbound rule for `onprem.retail.internal` pointing to the on-premises DNS servers, and associate the outbound rule directly with the Transit Gateway to apply it to all spoke VPCs. Configure on-premises DNS forwarders to route queries for `shared.retail.internal` to the inbound Resolver endpoint IP addresses.
Answer
Create Route 53 Resolver inbound and outbound endpoints in the Shared Services VPC. Authorize the cross-account association of the Private Hosted Zone with the spoke VPCs and associate them. Create a Route 53 Resolver outbound rule for the on-premises domain, share it via AWS Resource Access Manager (RAM), and associate it with each spoke VPC. Configure on-premises DNS forwarders to target the inbound Resolver endpoint IP addresses.
The correct solution uses a centralized Shared Services VPC to host Route 53 Resolver inbound and outbound endpoints, minimizing costs and duplicate endpoints. Spoke VPCs can resolve the Private Hosted Zone (PHZ) in the Shared Services account via cross-account VPC association, which is authorized by the owning account and then associated by the target account. Outbound resolution to the on-premises network is handled by a Route 53 Resolver outbound rule shared via AWS Resource Access Manager (RAM) and associated with the spoke VPCs. Inbound queries from on-premises to AWS are routed to the central inbound Resolver endpoint IP addresses, which can be reached via Transit Gateway routing.
Step-by-Step Solution
Key Concept
Centralized hybrid DNS architecture using Route 53 Resolver endpoints, cross-account Private Hosted Zone association, and Resource Access Manager sharing of outbound rules.