Examkin

Question

Difficulty: EasyMulti-Account and Hybrid DNS Architecture Strategy

A retail company manages its multi-account AWS environment. The core infrastructure team maintains a Route 53 Private Hosted Zone (PHZ) named service.internal in Account 111111111111. A development team in Account 222222222222 has deployed a microservice inside a new VPC and needs resources within this VPC to resolve domain names in service.internal. The VPCs in both accounts are connected via an AWS Transit Gateway. Which process should the Solutions Architect implement to enable name resolution for the microservice VPC in Account 222222222222?

  1. Authorize the cross-account association from Account 111111111111 using the AWS CLI or Route 53 API, and then associate the microservice VPC with the hosted zone from Account 222222222222.Answer
  2. B
    Share the Private Hosted Zone from Account 111111111111 with Account 222222222222 using AWS Resource Access Manager (RAM), and then accept the share in Account 222222222222.
  3. C
    Configure the Transit Gateway route tables to route DNS queries on port 53 from the microservice VPC directly to the Amazon-provided DNS server IP address of the core VPC in Account 111111111111.
  4. D
    Create a Private Hosted Zone named service.internal in Account 222222222222, define a Route 53 Resolver outbound endpoint in the microservice VPC, and configure a forwarding rule pointing to the VPC DNS resolver of Account 111111111111.

Answer

Authorize the cross-account association from the account owning the Private Hosted Zone using the AWS CLI or API, and then associate the VPC with the hosted zone from the account owning the VPC.
The correct answer describes the standard two-step AWS CLI/API workflow for cross-account Route 53 Private Hosted Zone (PHZ) association. The owner of the PHZ must first authorize the association with the external VPC, and then the owner of the VPC must perform the association.

Step-by-Step Solution

1
Submit a VPC association authorization from Account 111111111111.
Account 222222222222 is authorized to associate its VPC with the hosted zone service.internal.
VPCs and Private Hosted Zones in different accounts cannot be directly associated without explicit authorization.
2
Associate the microservice VPC with the service.internal Private Hosted Zone from Account 222222222222.
The microservice VPC is associated with the Private Hosted Zone.
This establishes the DNS resolution path for the resources in the microservice VPC.
3
Delete the association authorization from Account 111111111111 (optional).
The authorization is removed, but the active association remains intact.
This is a security best practice to clean up unused authorizations.

Key Concept

Cross-account Route 53 Private Hosted Zone association requires a two-step process: authorization from the hosted zone owner account, followed by the association request from the VPC owner account.
Estimated Time:1m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic