Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A global hospitality and travel conglomerate is designing a hybrid DNS resolution strategy for its multi-account AWS environment, which is connected to an on-premises datacenter via AWS Direct Connect. The on-premises environment hosts the DNS domain `hospitality.local`. Within AWS, a central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for `aws.hospitality.internal`. Several application VPCs exist in separate member accounts under AWS Organizations, and they must resolve both `hospitality.local` and `aws.hospitality.internal`. Additionally, on-premises systems must resolve `aws.hospitality.internal`.

Which combination of steps should a solutions architect perform to implement this DNS architecture? (Select TWO.)

  1. Authorize the association of the `aws.hospitality.internal` Private Hosted Zone with each consumer VPC in the application accounts by running the `CreateVPCAssociationAuthorization` API operation from the Shared Services account, and then complete the association in the application accounts.Answer
  2. Create an outbound Route 53 Resolver endpoint in a central Network VPC. Create a Route 53 Resolver forwarding rule for the `hospitality.local` domain that points to the on-premises DNS servers, share this rule with the organization using AWS Resource Access Manager (RAM), and associate it with all application VPCs.Answer
  3. C
    Associate the `aws.hospitality.internal` Private Hosted Zone only with the central Network VPC, allowing the application VPCs to transitively resolve the domain through the Transit Gateway connection without local zone associations.
  4. D
    Deploy a Route 53 Resolver inbound endpoint directly onto the Direct Connect Gateway, and configure the on-premises DNS servers to forward queries for `aws.hospitality.internal` to this endpoint's interface.
  5. E
    Share the `aws.hospitality.internal` Private Hosted Zone with the application accounts using AWS Resource Access Manager (RAM), allowing the administrator of each account to directly associate it with their VPCs.

Answer

Authorize the association of the Private Hosted Zone with consumer VPCs using the cross-account authorization API from the owner account, and create a Route 53 Resolver outbound forwarding rule for the on-premises domain in a central Network VPC, sharing it across the organization using AWS Resource Access Manager.
To resolve private hosted zones across accounts, you must establish an association between the zone and the consumer VPCs. Because the zone and the VPCs belong to different AWS accounts, the zone owner must first authorize the association, and the VPC owner must then submit the association request. For hybrid DNS resolution pointing to on-premises networks, Route 53 Resolver outbound endpoints are created in a central VPC, and forwarding rules are shared across the organization using AWS Resource Access Manager (RAM) to allow other VPCs to reuse the outbound connectivity.

Step-by-Step Solution

1
Set up outbound DNS resolution to the on-premises datacenter.
Create an outbound Route 53 Resolver endpoint in a centralized VPC. Define a Route 53 Resolver rule for `hospitality.local` pointing to the target IP addresses of the on-premises DNS servers.
This enables resources inside the AWS VPC network to forward query requests for the local on-premises domain to the on-premises DNS infrastructure.
2
Share the DNS forwarding rules with the member accounts.
Use AWS Resource Access Manager (RAM) to share the outbound resolver rule across the AWS Organization, and associate it with each application VPC.
Sharing the rule centrally avoids deploying duplicate resolver endpoints in every single member account VPC, reducing complexity and costs.
3
Enable cross-account Private Hosted Zone (PHZ) resolution.
Generate association authorizations using the `CreateVPCAssociationAuthorization` API command from the Shared Services account for each application VPC, and execute the association from the respective member accounts.
VPCs must be associated with the Private Hosted Zone to resolve its records, and AWS RAM does not support sharing Private Hosted Zones directly.

Key Concept

Cross-Account Private Hosted Zone Association and Centralized Hybrid DNS
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic