A financial services company is establishing a multi-account AWS environment. A central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for internal service discovery. A security policy requires that database workloads running in a separate Production account VPC must be able to resolve names within this central PHZ, without deploying duplicate hosted zones.
Which TWO steps are required to associate the central Private Hosted Zone with the VPC in the Production account? (Select TWO.)
- From the Shared Services account, create a VPC association authorization using the AWS CLI or API to authorize the Production account VPC.Answer
- From the Production account, associate the VPC with the Shared Services private hosted zone using the AWS CLI or API.Answer
- CFrom the Shared Services account, share the private hosted zone with the Production account using AWS Resource Access Manager (RAM), and then accept the share in the Production account.
- DFrom the Transit Gateway settings in the Shared Services account, enable DNS support on the Transit Gateway route table to automatically propagate the private hosted zone to all attached VPCs.
Answer
To associate a Route 53 Private Hosted Zone with a VPC in a different AWS account, you must first create a VPC association authorization from the account that owns the hosted zone, and then associate the VPC from the account that owns the VPC.
Associating a Route 53 Private Hosted Zone in one AWS account with a VPC in another AWS account is a two-step process that must be done using the AWS CLI or API. The hosted zone owner must first authorize the VPC association, and the VPC owner must then accept and associate the VPC.
Step-by-Step Solution
Key Concept
Cross-account Route 53 Private Hosted Zone association requires a two-step handshake via CLI/API: creating an association authorization from the hosted zone owner's account, and then performing the association from the VPC owner's account.