Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A global biotechnology corporation is migrating its laboratory management system to AWS. The company uses AWS Organizations and has established a multi-account environment with a central Transit VPC and multiple Spoke VPCs in different member accounts, all interconnected via AWS Transit Gateway. A dedicated Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) named `bio.internal`. The company also has an on-premises network connected via AWS Direct Connect to the Transit Gateway. On-premises research stations need to resolve records in `bio.internal`, while applications in the Spoke VPCs must resolve both `bio.internal` and on-premises server names in the `lab.local` domain. Which combination of steps should a Solutions Architect take to design a highly available, cost-effective hybrid DNS resolution architecture that meets these requirements?

  1. Deploy Route 53 Resolver inbound and outbound endpoints in the Transit VPC. Create an outbound resolver rule for `lab.local` pointing to the on-premises DNS servers, and share the rule with the organization using AWS Resource Access Manager (RAM). Associate this rule with the Spoke VPCs. In the Shared Services account, authorize the association of the `bio.internal` PHZ with the Transit VPC and all Spoke VPCs, and then accept the associations in the respective accounts. Configure the on-premises DNS servers to forward queries for `bio.internal` to the inbound endpoint IP addresses.Answer
  2. B
    Deploy Route 53 Resolver inbound and outbound endpoints in the Transit VPC. Create an outbound resolver rule for `lab.local` pointing to the on-premises DNS servers. Share the outbound resolver rule and the `bio.internal` Private Hosted Zone (PHZ) with the organization using AWS Resource Access Manager (RAM). Associate both shared resources with all Spoke VPCs and the Transit VPC. Configure the on-premises DNS servers to forward queries for `bio.internal` to the inbound endpoint IP addresses.
  3. C
    Deploy Route 53 Resolver inbound and outbound endpoints in the Transit VPC. Create an outbound resolver rule for `lab.local` pointing to the on-premises DNS servers, and share the rule with the organization using AWS Resource Access Manager (RAM). Associate the rule with all Spoke VPCs. In the Shared Services account, associate the `bio.internal` Private Hosted Zone (PHZ) with the Transit VPC only. In the Spoke VPCs, update the DHCP options sets to use the Transit VPC's inbound endpoint IP addresses as the domain name servers.
  4. D
    Deploy Route 53 Resolver inbound endpoints in the Transit VPC, and deploy outbound endpoints in each of the Spoke VPCs. Create an outbound resolver rule for `lab.local` in each Spoke VPC account. In the Shared Services account, associate the `bio.internal` Private Hosted Zone (PHZ) with the Transit VPC. Configure the on-premises DNS servers to forward queries for `bio.internal` directly to the Direct Connect Gateway rather than the inbound resolver endpoints.

Answer

Deploy Route 53 Resolver inbound and outbound endpoints in the Transit VPC. Create an outbound resolver rule for the on-premises domain, share it via AWS RAM, and associate it with the Spoke VPCs. Authorize and accept the cross-account association of the Private Hosted Zone with the Transit and Spoke VPCs using the Route 53 API. Configure on-premises DNS to forward queries to the inbound resolver endpoints.
The correct answer outlines a fully functional, highly available, and cost-effective hybrid DNS architecture. By centralizing the inbound and outbound Route 53 Resolver endpoints in the Transit VPC, the company avoids the high cost of deploying endpoints in every Spoke VPC. The outbound resolver rule for the on-premises domain is created once and shared via AWS Resource Access Manager (RAM) to all Spoke VPCs. Crucially, because Route 53 Private Hosted Zones cannot be shared via AWS RAM, the cross-account association workflow (authorization from the Shared Services account, followed by association from the Spoke accounts) is used to link the `bio.internal` PHZ directly to the Spoke VPCs and the Transit VPC. This allows Spoke VPCs to resolve `bio.internal` locally without querying cross-VPC endpoints, while the Transit VPC's inbound endpoint can resolve the zone for on-premises systems.

Step-by-Step Solution

1
Deploy centralized Route 53 Resolver inbound and outbound endpoints in the Transit VPC.
Establishes the network pathway for bidirectional DNS resolution between the AWS network and the on-premises environment.
Centralizing endpoints in a dedicated transit/hub VPC minimizes costs and administrative overhead compared to deploying endpoints in every Spoke VPC.
2
Create an outbound resolver rule for `lab.local` pointing to on-premises DNS, share it via AWS RAM with the organization, and associate it with the Spoke VPCs.
Allows resources in the Spoke VPCs to resolve the on-premises `lab.local` domain by routing queries through the Transit VPC's outbound resolver endpoints.
Route 53 Resolver rules can be shared across accounts using AWS RAM, allowing multi-account configurations to leverage a single pair of outbound endpoints.
3
Authorize and create cross-account VPC associations for the `bio.internal` Private Hosted Zone (PHZ) with the Transit VPC and all Spoke VPCs.
Allows resources in all Spoke VPCs to resolve `bio.internal` locally, and allows the inbound resolver endpoint in the Transit VPC to resolve it for on-premises clients.
Route 53 PHZs cannot be shared via AWS RAM. They must be associated with each VPC. For cross-account association, the PHZ owner account must authorize the association before the target VPC owner account can associate it.
4
Configure the on-premises DNS servers to forward queries for `bio.internal` to the inbound resolver endpoint IP addresses in the Transit VPC.
Enables on-premises systems to resolve the AWS-hosted `bio.internal` domain.
The inbound endpoints receive DNS queries from on-premises and forward them to the Route 53 Resolver service inside the Transit VPC, which resolves the records from the associated PHZ.

Key Concept

Centralized Route 53 Resolver design with cross-account Private Hosted Zone association and RAM-shared Resolver Rules in a hybrid network.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic