A global logistics provider is migrating its operations management system to AWS. The company uses AWS Organizations and has configured a multi-account structure with a centralized Network Services account. The Network Services account contains a Transit Gateway that connects VPCs in multiple member accounts and an on-premises data center via an AWS Direct Connect connection. The architecture team needs to implement a DNS resolution strategy that allows resources in all VPCs to resolve domain names in an on-premises zone named logistics.corp, while also allowing on-premises servers to resolve resources in a private hosted zone named aws.logistics.corp which is hosted in a Shared Services account. Which configuration should the solutions architect implement to meet these requirements with the least administrative effort?
- Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. In the Shared Services account, authorize the association of the aws.logistics.corp private hosted zone (PHZ) with the Network Services VPC. In the Network Services account, associate the VPC with the PHZ. Create an outbound Resolver rule for logistics.corp pointing to the on-premises DNS servers, share the rule with the organization using AWS Resource Access Manager (RAM), and associate the rule with all VPCs. Configure on-premises DNS servers to forward queries for aws.logistics.corp to the inbound endpoint IP addresses.Cevap
- BConfigure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. Share the aws.logistics.corp private hosted zone (PHZ) from the Shared Services account to all accounts using AWS Resource Access Manager (RAM). In the Network Services account, create an outbound Resolver rule for logistics.corp pointing to on-premises DNS servers, share the rule using AWS RAM, and associate it with all VPCs. Configure on-premises DNS servers to forward queries for aws.logistics.corp to the inbound endpoint IP addresses.
- CConfigure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. Create a Direct Connect Gateway (DXGW) and configure DNS forwarding rules directly on the DXGW to route logistics.corp queries to the on-premises DNS servers without using Route 53 Resolver outbound rules. Authorize and associate the aws.logistics.corp private hosted zone (PHZ) with the Network Services VPC, and configure on-premises DNS to forward queries to the inbound endpoint IP addresses over the Transit Gateway.
- DConfigure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. In the Shared Services account, associate the aws.logistics.corp private hosted zone (PHZ) directly with the inbound endpoint in the Network Services VPC. Create an outbound Resolver rule for logistics.corp pointing to on-premises DNS servers, and configure a VPC Peering connection between the Shared Services VPC and the Network Services VPC to route DNS traffic.