Examkin

Question

Difficulty: Very hardMulti-Account and Hybrid DNS Architecture Strategy

A global financial technology enterprise is migrating its core banking ledger to AWS. The hybrid network architecture consists of an on-premises mainframe data center and a multi-account AWS environment managed by AWS Organizations. The on-premises DNS servers host the `onprem.bank.internal` zone. A central transit VPC is deployed in a dedicated `Network` AWS account, which is connected to the on-premises network via AWS Direct Connect and an AWS Transit Gateway. Separate business units run workloads in their own AWS accounts (such as `Account-A` and `Account-B`), with each VPC attached to the central Transit Gateway. A Private Hosted Zone (PHZ) for `cloud.bank.internal` is created in a centralized `SharedServices` AWS account. The enterprise requires that:

1. On-premises systems must resolve resource records in `cloud.bank.internal`.
2. Workloads in `Account-A` and `Account-B` must resolve resource records in both `onprem.bank.internal` and `cloud.bank.internal`.
3. DNS queries and network traffic must not traverse the public internet, and administrative overhead must be minimized.

Which TWO actions must a solutions architect perform to implement this hybrid and multi-account DNS architecture? (Select TWO.)

  1. In the `Network` account, create a Route 53 Resolver outbound endpoint in the transit VPC. Create a resolver rule for `onprem.bank.internal` pointing to the on-premises DNS servers, associate the rule with the outbound endpoint, share the rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate the shared rule with the VPCs in `Account-A` and `Account-B`.Answer
  2. In the `Network` account, create Route 53 Resolver inbound endpoints in the transit VPC, and configure the on-premises DNS servers to forward queries for `cloud.bank.internal` to the inbound endpoint IP addresses. Authorize cross-account VPC associations for the `cloud.bank.internal` hosted zone from the `SharedServices` account to the transit VPC and the VPCs in `Account-A` and `Account-B`, and associate the VPCs in their respective accounts.Answer
  3. C
    Share the `cloud.bank.internal` Private Hosted Zone from the `SharedServices` account with the AWS Organization using AWS Resource Access Manager (RAM). In `Account-A`, `Account-B`, and the `Network` account, associate the shared hosted zone with the respective VPCs.
  4. D
    In the `SharedServices` account, create a Route 53 Resolver outbound endpoint in its VPC. Create a resolver rule for `onprem.bank.internal` pointing to the on-premises DNS servers, and share the outbound endpoint directly via AWS Resource Access Manager (RAM) with `Account-A` and `Account-B`.
  5. E
    In both `Account-A` and `Account-B`, create Route 53 Resolver inbound endpoints in their respective application VPCs. Configure on-premises DNS servers to forward queries for `cloud.bank.internal` to these inbound endpoints, and use AWS Transit Gateway routing to load-balance DNS queries between them.
  6. F
    Create identical Private Hosted Zones named `cloud.bank.internal` in `Account-A`, `Account-B`, and the `Network` AWS accounts. Use Route 53 Resolver outbound rules to synchronize the resource records of these local hosted zones with the master zone in the `SharedServices` account.

Answer

To resolve the on-premises domain, create a Route 53 Resolver outbound endpoint in the transit VPC, associate it with a forwarding rule for the on-premises domain, share the rule via AWS RAM, and associate it with the application VPCs. To resolve the AWS private hosted zone from on-premises, create Route 53 Resolver inbound endpoints in the transit VPC and forward queries from on-premises. To resolve it from the application VPCs, authorize and associate the private hosted zone in the shared services account with the transit and application VPCs.
To establish hybrid DNS resolution, a centralized outbound endpoint in the transit VPC (which has Direct Connect/VPN connectivity) handles queries from AWS to on-premises. The forwarding rule is shared via AWS RAM so that spoke VPCs in other accounts can reuse the central endpoint, avoiding redundant deployments. For on-premises systems to resolve AWS records, inbound endpoints are deployed in the transit VPC. To allow the spoke and transit VPCs to resolve the private hosted zone hosted in the central shared services account, cross-account VPC association authorizations must be created by the zone owner and accepted by the VPC owners, as Private Hosted Zones cannot be shared via AWS RAM.

Step-by-Step Solution

1
Deploy Route 53 Resolver outbound endpoints in the centralized transit VPC which has direct hybrid connectivity to the on-premises network.
The transit VPC can forward DNS queries to the on-premises DNS servers IP addresses.
Outbound DNS resolution from AWS to on-premises requires network paths and outbound endpoints situated in a VPC connected to the on-premises environment.
2
Create a Route 53 Resolver forwarding rule for the on-premises domain in the central network account, associate it with the outbound endpoint, and share the rule via AWS RAM with the organization.
The forwarding rule becomes available for association in the application accounts.
Sharing the rule via AWS RAM prevents the need to deploy costly outbound endpoints in every individual spoke VPC.
3
In the application accounts, associate the shared resolver rule with the application VPCs.
Workloads in the application VPCs can resolve the on-premises domain.
Associating the shared rule directs the local VPC resolvers to route queries for the on-premises domain through the central outbound endpoint.
4
In the central network account, create Route 53 Resolver inbound endpoints in the transit VPC, and configure the on-premises DNS servers to forward queries for the AWS private domain to the inbound endpoint IP addresses.
On-premises systems can reach the inbound endpoints and resolve AWS internal records.
Inbound endpoints act as forwarding targets for external DNS servers to resolve private hosted zones within AWS.
5
From the shared services account, authorize cross-account VPC associations for the private hosted zone to the transit VPC and the application VPCs. From the respective owner accounts, accept and complete the associations.
The private hosted zone is associated with all VPCs across the accounts.
Since Private Hosted Zones cannot be shared via AWS RAM, cross-account VPC association authorization and association API calls are required to allow the VPCs to resolve records in the hosted zone.

Key Concept

Route 53 Resolver Endpoints and Cross-Account Private Hosted Zone Association
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic