Examkin

Question

Difficulty: EasyNetworking and Connectivity Design

An enterprise is setting up a multi-account environment on AWS. A central Shared Services account contains a Route 53 Private Hosted Zone (PHZ) named `internal.infra` that hosts DNS records for shared infrastructure resources. Two new application VPCs, `vpc-app-dev` and `vpc-app-prod`, are deployed in separate AWS member accounts. The workloads in these application VPCs must resolve domain names within `internal.infra` with minimal latency and without exposing the traffic to the public internet. Which of the following approaches satisfies these requirements with the least operational complexity?

  1. A
    Deploy AWS Transit Gateway to connect all VPCs and enable DNS resolution support on the Transit Gateway attachments to transitively route DNS queries from the application VPCs to the Private Hosted Zone.
  2. B
    Create separate copies of the `internal.infra` Private Hosted Zone in each application account, and implement an AWS Lambda function to synchronize DNS records between the three hosted zones.
  3. Authorize the association of the `internal.infra` Private Hosted Zone with `vpc-app-dev` and `vpc-app-prod` from the Shared Services account, and then associate the VPCs with the hosted zone from the respective member accounts.Answer
  4. D
    Deploy a single NAT Gateway in the Shared Services VPC, and configure the application VPCs to forward DNS queries to a Route 53 Inbound Resolver endpoint in the Shared Services VPC via this NAT Gateway.

Answer

Authorize the association of the Private Hosted Zone with the member VPCs from the Shared Services account, and then associate the VPCs with the hosted zone from the member accounts.
The correct approach is to authorize the cross-account association from the Shared Services account and then perform the association from the member accounts. This allows resources in the application VPCs to resolve domain names in the Private Hosted Zone directly and natively using their local Route 53 Resolver (the VPC CIDR plus two address). This design provides the lowest latency, avoids additional network infrastructure costs, and eliminates single points of failure.

Step-by-Step Solution

1
Create an association authorization from the owner account.
Grants permission for the target VPCs in the consumer accounts to link to the Private Hosted Zone.
Route 53 requires explicit authorization from the hosted zone's owning account before a VPC in a different AWS account can be associated with it.
2
Associate the VPCs from the consumer accounts.
The target VPCs are linked to the Private Hosted Zone, enabling local DNS resolution of its records.
Once authorized, the VPC owner must accept or execute the association to enable the Route 53 Resolver in that VPC to answer queries for the zone.

Key Concept

Cross-Account Route 53 Private Hosted Zone Association
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic