An enterprise has a multi-account AWS Organization. Account A hosts an Amazon Aurora PostgreSQL database cluster in a private VPC subnet. Account B hosts a critical business application running on Amazon ECS tasks in a private VPC subnet. Network connectivity between the two VPCs is established using an AWS Transit Gateway. The database cluster has IAM database authentication enabled. The security team requires that the application in Account B must connect to the database in Account A securely, using private DNS resolution and the principle of least privilege, while avoiding the use of long-term credentials.
Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)
- In Account A, authorize the association of the Route 53 Private Hosted Zone with the VPC in Account B. In Account B, associate the VPC with the hosted zone to enable private DNS resolution of the database endpoint.Answer
- In Account A, create an IAM role with a trust policy that allows Account B's ECS task role to assume it, and attach an IAM policy allowing the rds-db:connect action. In Account B, configure the application to assume this role and generate a temporary database connection token.Answer
- CIn Account B, create a duplicate Route 53 Private Hosted Zone with the same domain name as Account A's zone, and use AWS Resource Access Manager (RAM) to share this zone with Account A to enable endpoint resolution.
- DConfigure Account A's database to use the default AWS-managed KMS key (aws/rds) for encryption, and add a key policy statement allowing Account B's ECS task role to use the key for decryption.
- EConfigure a Direct Connect gateway directly between Account A's VPC and Account B's VPC, and configure the Direct Connect gateway route tables to handle database traffic routing instead of using the Transit Gateway.
Answer
The correct actions are: authorizing and associating the Route 53 Private Hosted Zone from Account A with the VPC in Account B, and creating a cross-account IAM role in Account A that the ECS task role in Account B can assume to connect to the database via IAM database authentication.
To secure the cross-account database connection with private DNS resolution, the Solutions Architect must authorize and associate the Private Hosted Zone in Account A with Account B's VPC. Additionally, to avoid long-term credentials and follow the principle of least privilege, the Solutions Architect must configure a cross-account IAM role in Account A that Account B's ECS task role can assume, which grants permissions to connect to the database via IAM database authentication.
Step-by-Step Solution
Key Concept
Cross-account IAM authentication and private DNS resolution to secure multi-account database traffic.