Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

An energy conglomerate is migrating its legacy power grid monitoring applications to AWS across multiple member accounts under AWS Organizations. The central network architecture uses an AWS Transit Gateway to connect several application VPCs to a central Shared Services VPC. The Shared Services VPC has a Direct Connect connection to the on-premises data center. The company has a Route 53 Private Hosted Zone (PHZ) named `grid.internal` in the Shared Services account, while on-premises servers use the domain `substation.internal` managed by on-premises DNS servers. The cloud engineering team must establish bidirectional DNS resolution between all VPCs and the on-premises environment.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create Route 53 Resolver inbound endpoints in the Shared Services VPC to receive DNS queries for `grid.internal` from the on-premises DNS servers, and create Route 53 Resolver outbound endpoints with forwarding rules for `substation.internal` shared with the application accounts via AWS Resource Access Manager (RAM).Answer
  2. Authorize the association of the `grid.internal` Private Hosted Zone in the Shared Services account with the application VPCs in the member accounts, and then associate the Private Hosted Zone with each application VPC.Answer
  3. C
    Associate the `grid.internal` Private Hosted Zone directly with the Route 53 Resolver outbound endpoint in the Shared Services VPC, enabling automatic transit routing and resolution of the private domain across all peer VPCs and the on-premises network.
  4. D
    Configure the on-premises DNS servers to forward queries for `grid.internal` directly to the AWS Transit Gateway attachment IP addresses, and configure the Transit Gateway route tables to forward port 53 DNS traffic to the Direct Connect Gateway.

Answer

The solutions architect must create Route 53 Resolver inbound endpoints in the Shared Services VPC to receive queries from on-premises DNS servers, create Route 53 Resolver outbound endpoints with forwarding rules shared via AWS Resource Access Manager for the on-premises domain, and associate the central Private Hosted Zone with all member VPCs using cross-account Private Hosted Zone association authorization.
Establishing hybrid bidirectional DNS resolution requires two main configurations. First, to allow AWS VPCs to query the on-premises domain and on-premises servers to query AWS domains, Route 53 Resolver inbound and outbound endpoints are established in the Shared Services VPC, with rules shared across accounts via AWS Resource Access Manager. Second, to allow application VPCs in member accounts to resolve private DNS records from the centralized Private Hosted Zone, the zone must be explicitly associated with those VPCs through a cross-account authorization process.

Step-by-Step Solution

1
Set up inbound DNS resolution from on-premises to AWS.
Create Route 53 Resolver inbound endpoints in the Shared Services VPC. Configure on-premises DNS servers to forward queries for the internal domain to the inbound endpoint IP addresses.
This enables on-premises clients to resolve resource records in the AWS Private Hosted Zone.
2
Set up outbound DNS resolution from AWS to on-premises.
Create Route 53 Resolver outbound endpoints in the Shared Services VPC. Define a Resolver rule forwarding queries for the on-premises domain to the on-premises DNS servers. Share this rule with member accounts using AWS Resource Access Manager, and associate it with all VPCs.
This allows resource lookup for the on-premises domain from any VPC in the organization.
3
Configure cross-account Private Hosted Zone association.
Authorize the association of the internal Private Hosted Zone with the application VPCs using the Shared Services account credentials, and then associate the zone from each member account.
VPCs in member accounts cannot resolve records in the central Private Hosted Zone unless it is associated with those VPCs.

Key Concept

Multi-Account and Hybrid DNS Architecture Strategy using Route 53 Resolver and cross-account Private Hosted Zone associations
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic