Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

A financial services enterprise is establishing a hybrid environment connecting its on-premises datacenter to a multi-account AWS environment. A central network account contains a Transit VPC with Route 53 Resolver inbound and outbound endpoints, connected to the on-premises DNS servers via AWS Direct Connect and AWS Transit Gateway. The Transit VPC also hosts a Route 53 Private Hosted Zone (PHZ) for corp.internal. Multiple application accounts run workloads in separate VPCs connected via Transit Gateway. The company needs on-premises servers to resolve names in corp.internal, and AWS workloads in the application VPCs to resolve both corp.internal and on-premises domains ending in onprem.internal. Which configuration achieves this hybrid DNS resolution with the minimum number of endpoints?

  1. A
    Share the corp.internal private hosted zone directly with the application accounts using AWS Resource Access Manager, and associate the application VPCs with the shared hosted zone. Configure Route 53 Resolver outbound rules in the network account to forward queries for onprem.internal to the on-premises DNS servers, and share these rules with the application accounts using AWS Resource Access Manager.
  2. B
    Associate the corp.internal private hosted zone with the application VPCs by authorizing the association from the central network account and creating the association from the member accounts. Configure Route 53 Resolver outbound rules in the network account to forward queries for onprem.internal to the on-premises DNS servers, but route the outbound DNS queries directly via a Direct Connect Gateway, bypassing Transit Gateway routing.
  3. Associate the corp.internal private hosted zone with the application VPCs by authorizing the association from the central network account and creating the association from the member accounts. Configure Route 53 Resolver outbound rules in the network account to forward queries for onprem.internal to the on-premises DNS servers, and share these rules with the application accounts using AWS Resource Access Manager. Configure the on-premises DNS servers to forward queries for corp.internal to the inbound resolver endpoint in the Transit VPC.Cevap
  4. D
    Create Route 53 Resolver inbound and outbound endpoints in each application VPC. Configure the on-premises DNS servers to forward queries for corp.internal to each application VPC's inbound endpoint. Configure local forwarding rules in each application VPC to send queries for onprem.internal directly to the on-premises DNS servers.

Cevap

Associate the private hosted zone with the application VPCs via cross-account association, share the outbound resolver rules via AWS Resource Access Manager, and forward on-premises queries to the inbound resolver endpoint in the Transit VPC.
The correct configuration associates the Private Hosted Zone with the application VPCs by authorizing the cross-account association from the network account and completing the association from the application accounts. It utilizes Route 53 Resolver outbound rules configured in the central network VPC, shared via AWS Resource Access Manager to the application accounts, to forward queries for the on-premises domain to the on-premises DNS servers. On-premises DNS servers are configured to forward queries for the AWS domain to the central inbound resolver endpoint. This setup minimizes costs and complexity by sharing endpoints and avoiding redundant DNS forwarding hops.

Adım Adım Çözüm

1
Enable cross-account Private Hosted Zone resolution.
Authorize the association of the corp.internal Private Hosted Zone with the application VPCs from the central network account using the AWS CLI or SDK, and then associate the VPCs with the hosted zone from the member accounts.
This allows instances in the application VPCs to resolve records in corp.internal locally without routing queries through resolver endpoints, minimizing costs and latency.
2
Configure outbound DNS resolution from AWS to on-premises.
Create a Route 53 Resolver outbound endpoint in the central network Transit VPC. Define a resolver rule to forward queries for onprem.internal to the on-premises DNS servers. Share the rule with application accounts using AWS Resource Access Manager (RAM) and associate it with the application VPCs.
Sharing a single outbound endpoint and rule across the organization avoids the cost and administrative overhead of deploying outbound endpoints in every VPC.
3
Configure inbound DNS resolution from on-premises to AWS.
Create a Route 53 Resolver inbound endpoint in the central network Transit VPC. Configure the on-premises DNS servers to conditionally forward queries for corp.internal to the IP addresses of the inbound endpoint.
This allows on-premises systems to resolve resources hosted inside the AWS multi-account environment through the hybrid connection.

Anahtar Kavram

Cross-account Private Hosted Zone association and sharing central Route 53 Resolver rules via AWS Resource Access Manager to optimize costs and architecture in a hybrid environment.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru