Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

An online media streaming enterprise manages its AWS environment using AWS Organizations. The architecture consists of a `Shared-Network` account hosting a central Transit Gateway (TGW) and a Hub VPC, and a `Content-Delivery` account hosting a Spoke VPC containing application workloads. The Spoke VPC and Hub VPC are attached to the TGW, and the TGW connects to the enterprise's on-premises network via an AWS Direct Connect connection.

The on-premises network hosts local servers using the domain `corp.internal`. The `Content-Delivery` account hosts a Route 53 Private Hosted Zone (PHZ) for `stream.aws.internal` associated with its Spoke VPC. The `Shared-Network` account hosts a PHZ for `common.aws.internal` associated with its Hub VPC. The enterprise requires that:
1. On-premises clients must be able to resolve DNS records in both `stream.aws.internal` and `common.aws.internal`.
2. EC2 instances in both the Hub VPC and the Spoke VPC must be able to resolve DNS records in `corp.internal`.
3. Administrative overhead and costs must be minimized by avoiding redundant endpoints and ensuring DNS query loops are prevented.

Which of the following configuration strategies should a solutions architect implement to meet these requirements?

  1. A
    Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC. In the `Shared-Network` account, create an Outbound Resolver forwarding rule for `corp.internal` pointing to the on-premises DNS servers, share this rule with the Organization via AWS Resource Access Manager (RAM), and associate it with both VPCs. Share the `stream.aws.internal` Private Hosted Zone from the `Content-Delivery` account with the `Shared-Network` account using AWS RAM, and associate it with the Hub VPC. Configure on-premises DNS servers to forward queries for `aws.internal` to the Inbound Endpoints.
  2. B
    Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC. In the `Shared-Network` account, create an Outbound Resolver forwarding rule for `corp.internal` pointing to the on-premises DNS servers, share this rule with the Organization via AWS Resource Access Manager (RAM), and associate it with both VPCs. Keep the `stream.aws.internal` Private Hosted Zone associated only with the Spoke VPC in the `Content-Delivery` account. Configure on-premises DNS servers to forward queries for `aws.internal` to the Inbound Endpoints.
  3. Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC. In the `Shared-Network` account, create an Outbound Resolver forwarding rule for `corp.internal` pointing to the on-premises DNS servers, share this rule with the Organization via AWS Resource Access Manager (RAM), and associate it with both VPCs. In the `Content-Delivery` account, authorize the association of `stream.aws.internal` with the Hub VPC, and then associate the zone from the `Shared-Network` account. Configure on-premises DNS servers to forward queries for `aws.internal` to the Inbound Endpoints.Answer
  4. D
    Deploy Route 53 Resolver Inbound Endpoints in the Hub VPC and Outbound Endpoints in the Spoke VPC. In the `Content-Delivery` account, create an Outbound Resolver rule for `stream.aws.internal` pointing to the Inbound Endpoints in the Hub VPC. Configure on-premises DNS servers to forward queries for `aws.internal` to the Outbound Endpoints in the Spoke VPC using the Direct Connect Gateway's public virtual interface for routing.

Answer

Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC. In the Shared-Network account, create an Outbound Resolver forwarding rule for corp.internal pointing to the on-premises DNS servers, share this rule with the Organization via AWS Resource Access Manager (RAM), and associate it with both VPCs. In the Content-Delivery account, authorize the association of stream.aws.internal with the Hub VPC, and then associate the zone from the Shared-Network account. Configure on-premises DNS servers to forward queries for aws.internal to the Inbound Endpoints.
The correct configuration centralizes Route 53 Resolver Inbound and Outbound Endpoints within the Hub VPC to optimize architecture and minimize costs. To allow on-premises clients to resolve records in a Private Hosted Zone owned by another AWS account, the zone must be associated with the Hub VPC containing the Inbound Endpoints. This requires submitting a cross-account hosted zone association authorization from the owning account, and then associating the zone from the Network Services account. Outbound resolution for the on-premises domain is resolved by creating a forwarding rule and sharing it using AWS Resource Access Manager (RAM).

Step-by-Step Solution

1
Configure central Route 53 Resolver Inbound and Outbound Endpoints in the Shared-Network account's Hub VPC.
Establishes a single network ingress and egress point for hybrid DNS queries, minimizing resource costs.
Centralizing endpoints in a Hub VPC avoids deploying duplicate endpoints in every spoke VPC.
2
Create an Outbound forwarding rule for corp.internal in the Shared-Network account pointing to the on-premises DNS servers.
A Resolver forwarding rule is created and subsequently shared with the entire AWS Organization using AWS Resource Access Manager (RAM).
Allows both the Hub VPC and the Spoke VPC to forward on-premises DNS queries via the shared rule and the central Outbound Endpoints.
3
Authorize and associate the stream.aws.internal Private Hosted Zone (PHZ) with the Hub VPC.
The Content-Delivery account authorizes the cross-account association, and the Shared-Network account associates the hosted zone with the Hub VPC.
Route 53 Inbound Endpoints can only resolve PHZs associated with the VPC they reside in. Associating stream.aws.internal with the Hub VPC enables the Inbound Endpoints to resolve its records for on-premises clients.

Key Concept

Cross-account Private Hosted Zone association and Route 53 Resolver rule sharing in a hub-and-spoke hybrid network
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic