Examkin

Question

Difficulty: Very hardMulti-Account and Hybrid DNS Architecture Strategy

A global financial payment processor manages its multi-account environment on AWS using AWS Organizations. The network topology consists of a central Network Services Account containing a Shared Services VPC that acts as a hub, connected to multiple application VPCs in member accounts via AWS Transit Gateway. The Shared Services VPC has inbound and outbound Route 53 Resolver endpoints to handle hybrid DNS resolution with an on-premises data center connected via AWS Direct Connect.

An application team in Account A (Production) hosts a critical payment service and creates a Route 53 Private Hosted Zone (PHZ) named `prod.payments.internal` associated with the Production VPC in Account A. An on-premises payment gateway needs to resolve hostnames within `prod.payments.internal` via the Direct Connect connection. Additionally, workloads running in other member account VPCs must also be able to resolve these hostnames.

Which configuration strategy must a solutions architect implement to meet these requirements with the least administrative overhead while ensuring that DNS traffic complies with the centralized hybrid network design?

  1. In Account A, submit a cross-account VPC association authorization to link the private hosted zone with the Shared Services VPC in the Network Services Account. From the Network Services Account, accept the association request using the AWS CLI or Route 53 API. Configure the on-premises DNS servers to forward queries for the domain to the inbound Route 53 Resolver endpoint IP addresses in the Shared Services VPC. Repeat the cross-account authorization and association process for any other member account VPCs requiring resolution.Answer
  2. B
    Create a Route 53 Resolver outbound rule in the Network Services Account for the domain, targeting the Transit Gateway's network interfaces. Share the rule with Account A and the other member accounts using AWS Resource Access Manager (RAM). In each member account, associate the shared rule with the respective application VPCs, and configure on-premises DNS servers to forward queries directly to the Transit Gateway's elastic network interfaces.
  3. C
    In the Network Services Account, open the Route 53 console and associate the Shared Services VPC directly with the private hosted zone hosted in Account A. Configure the on-premises DNS servers to forward all queries for the domain to the inbound Route 53 Resolver endpoint IP addresses in the Shared Services VPC. In each member account VPC, configure the local VPC DHCP options set to point to the inbound endpoint in the Shared Services VPC.
  4. D
    Use AWS Resource Access Manager (RAM) to share the private hosted zone from Account A with the AWS Organization. Once shared, associate the private hosted zone with the Shared Services VPC in the Network Services Account and the other application VPCs. Configure the on-premises DNS servers to forward queries for the domain to the inbound Route 53 Resolver endpoint IP addresses in the Shared Services VPC.

Answer

Authorize the association of the Private Hosted Zone in Account A with the Shared Services VPC, accept the association from the Network Services Account via the API/CLI, and forward on-premises DNS queries to the inbound Route 53 Resolver endpoints.
The correct strategy involves authorizing the cross-account association of the Private Hosted Zone from Account A using the API or CLI, followed by associating it with the Shared Services VPC in the Network Services Account. Since on-premises queries are forwarded to the inbound resolver endpoint residing in the Shared Services VPC, the endpoint can resolve the queries by accessing the newly associated Private Hosted Zone. Similarly, authorizing and associating the zone with other VPCs enables their native resolvers to resolve the domain without creating loops or forwarding rules.

Step-by-Step Solution

1
Authorize cross-account VPC association from the zone owner account.
From Account A, execute the AWS CLI command `aws route53 create-vpc-association-authorization` targeting the Shared Services VPC ID in the Network Services Account.
Before a VPC in another account can be associated with a Private Hosted Zone, the account owning the hosted zone must explicitly authorize the association.
2
Associate the target VPC with the Private Hosted Zone from the target VPC owner account.
From the Network Services Account, execute the AWS CLI command `aws route53 associate-vpc-with-hosted-zone` targeting the Private Hosted Zone ID and the Shared Services VPC ID.
This establishes the logical link so that the DNS server of the Shared Services VPC (which hosts the inbound resolver endpoint) can query the Private Hosted Zone.
3
Configure hybrid DNS routing on-premises.
On-premises DNS forwarders route queries for the domain to the IP addresses of the inbound Route 53 Resolver endpoints.
Inbound endpoints process incoming queries from on-premises over AWS Direct Connect and resolve them using the associated VPC's DNS resolver.
4
Associate other application VPCs with the hosted zone.
Repeat the authorization and association commands for all other application VPCs requiring name resolution of the domain.
Workloads in other VPCs need direct association to resolve the domain using the VPC's default DNS server (10.0.0.210.0.0.2 or equivalent).

Key Concept

Cross-Account Route 53 Private Hosted Zone Association and Hybrid Resolution
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic