Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A global e-commerce and logistics company manages its multi-account environment using AWS Organizations. The core network consists of a central Hub VPC in a Shared Services account and several spoke VPCs in Line of Business (LoB) accounts, all interconnected via an AWS Transit Gateway. The Shared Services VPC has an active AWS Direct Connect connection to the on-premises datacenter. The company needs to design a hybrid DNS resolution strategy. On-premises systems must resolve resources in a Private Hosted Zone (PHZ) for `aws.ecommerce.internal` hosted in the Shared Services account. Additionally, all spoke VPCs must resolve both the `aws.ecommerce.internal` domain and the on-premises domain `corp.internal`. Which TWO configurations should the solutions architect implement to meet these requirements? (Select TWO.)

  1. In the Shared Services account, create Route 53 Resolver outbound endpoints in the Shared Services VPC. Create an outbound Resolver rule for the `corp.internal` domain pointing to the on-premises DNS servers, share this rule with the organization using AWS Resource Access Manager (RAM), and associate the shared rule with the spoke VPCs.Answer
  2. In the Shared Services account, authorize the association of the `aws.ecommerce.internal` Private Hosted Zone with the spoke VPCs in the LoB accounts using the Route 53 API. In each LoB account, associate the Private Hosted Zone with the respective spoke VPCs. Create Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `aws.ecommerce.internal` to the inbound endpoint IP addresses.Answer
  3. C
    Share the `aws.ecommerce.internal` Private Hosted Zone from the Shared Services account with the LoB accounts using AWS Resource Access Manager (RAM). In each LoB account, accept the resource share and associate the Private Hosted Zone with the spoke VPCs.
  4. D
    In the Shared Services VPC, configure Route 53 Resolver inbound endpoints to route queries for the `corp.internal` domain to the on-premises DNS servers, and configure the Direct Connect Gateway to route DNS traffic directly to the spoke VPCs.

Answer

The configurations to implement are: creating Route 53 Resolver outbound endpoints in the Shared Services VPC, sharing an outbound Resolver rule for `corp.internal` via AWS RAM, and associating it with the spoke VPCs; and authorizing the cross-account association of the `aws.ecommerce.internal` Private Hosted Zone with the spoke VPCs using the Route 53 API, completing the association in each LoB account, and deploying Route 53 Resolver inbound endpoints in the Shared Services VPC for on-premises DNS forwarding.
The correct configurations involve setting up a centralized hybrid DNS hub-and-spoke pattern. To resolve the on-premises domain, outbound Route 53 Resolver endpoints are placed in the central VPC, and an outbound rule for `corp.internal` is shared with LoB accounts via AWS RAM. To resolve the private domain from spoke VPCs, the PHZ in the Shared Services account is authorized and associated with the spoke VPCs using the Route 53 API. To resolve the private domain from on-premises, Route 53 Resolver inbound endpoints are placed in the central VPC, and on-premises DNS servers are configured to forward queries to these endpoints.

Step-by-Step Solution

1
Set up outbound DNS resolution for the on-premises domain.
Create Route 53 Resolver outbound endpoints in the central Shared Services VPC. Define a Resolver rule for `corp.internal` pointing to on-premises DNS servers, share it with the LoB accounts using AWS RAM, and associate the rule with the spoke VPCs.
This allows all spoke VPCs to forward DNS queries for the on-premises domain to the central outbound endpoints, which send the traffic across the Direct Connect connection to the on-premises DNS servers.
2
Set up cross-account resolution for the AWS private domain.
Authorize the association of the `aws.ecommerce.internal` Private Hosted Zone (PHZ) in the Shared Services account with the spoke VPCs in the LoB accounts, then perform the association in each LoB account.
VPCs can only resolve domains in a PHZ if they are explicitly associated with it. For cross-account VPCs, this requires a two-step authorization and association process.
3
Set up inbound DNS resolution from on-premises.
Create Route 53 Resolver inbound endpoints in the Shared Services VPC. Configure on-premises DNS forwarders to route queries for `aws.ecommerce.internal` to the inbound endpoint IP addresses.
This allows on-premises clients to query the inbound endpoint, which can resolve the PHZ associated with the Shared Services VPC.

Key Concept

Hybrid DNS routing requires a combination of Route 53 Resolver inbound endpoints (for on-premises to AWS query flow), outbound endpoints and rules shared via AWS RAM (for AWS to on-premises query flow), and cross-account Private Hosted Zone association to enable DNS resolution across different AWS accounts.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic