A media streaming company uses AWS Organizations to manage a multi-account environment. A … — AWS Certified Solutions Architect - Professional

A media streaming company uses AWS Organizations to manage a multi-account environment. A central Shared Services VPC in the `Network` account contains Route 53 Resolver inbound and outbound endpoints, connected to the on-premises network via AWS Transit Gateway and AWS Direct Connect. A Private Hosted Zone (PHZ) for `media.internal` is hosted in the `Production` account. A new Development VPC has been created in the `Development` account. Developers in the `Development` account require resolution of hostnames in `media.internal` from the Development VPC. Additionally, servers in the on-premises datacenter must resolve hostnames in `media.internal`.

Which of the following architectures will allow both the Development VPC and the on-premises network to resolve hostnames in `media.internal` with the lowest latency and administrative overhead?

In the Production account, authorize the association of the `media.internal` Private Hosted Zone with both the Development VPC and the Shared Services VPC. In the Development account, associate the Development VPC with the Private Hosted Zone. In the Network account, associate the Shared Services VPC with the Private Hosted Zone. Configure the on-premises DNS servers to forward queries for `media.internal` to the inbound resolver endpoint IP addresses in the Shared Services VPC.Cevap
B
In the Production account, use AWS Resource Access Manager (RAM) to share the `media.internal` Private Hosted Zone with the AWS Organization. In the Development and Network accounts, accept the shared resource. Associate the Shared Services VPC and the Development VPC with the shared Private Hosted Zone. Configure the on-premises DNS servers to forward queries for `media.internal` to the inbound resolver endpoint IP addresses in the Shared Services VPC.
C
In the Production account, authorize the association of the `media.internal` Private Hosted Zone with the Development VPC and associate it. In the Network account, configure a Route 53 Resolver outbound rule for `media.internal` pointing to the Production VPC's Route 53 Resolver IP address ( $169.254.169.253$ ), and share it with the Development account via AWS RAM. Configure the on-premises DNS servers to forward queries for `media.internal` directly to the link-local Route 53 Resolver IP address ( $169.254.169.253$ ) in the Shared Services VPC over the Direct Connect connection.
D
In the Production account, authorize the association of the `media.internal` Private Hosted Zone with the Shared Services VPC and complete the association in the Network account. In the Development account, create an outbound resolver rule for `media.internal` targeting the inbound resolver endpoint IPs in the Shared Services VPC, and route all DNS traffic over a Direct Connect Gateway public virtual interface without using Transit Gateway.

Cevap

In the Production account, authorize the association of the `media.internal` Private Hosted Zone with both the Development VPC and the Shared Services VPC. In the Development account, associate the Development VPC with the Private Hosted Zone. In the Network account, associate the Shared Services VPC with the Private Hosted Zone. Configure the on-premises DNS servers to forward queries for `media.internal` to the inbound resolver endpoint IP addresses in the Shared Services VPC.

The correct solution involves using Route 53 cross-account Private Hosted Zone (PHZ) association. The Production account (owner of the PHZ) must authorize the association for the Development VPC and the Shared Services VPC. The consumer accounts then complete the association. Once the PHZ is associated with the Shared Services VPC, the inbound resolver endpoint in that VPC can answer queries for `media.internal` forwarded from the on-premises DNS servers.

Adım Adım Çözüm

Authorize cross-account Private Hosted Zone (PHZ) association from the owner account.

VPC association authorizations are created in the Production account for the Development VPC and the Shared Services VPC.

Before a VPC in another AWS account can be associated with a PHZ, the account that owns the PHZ must explicitly authorize the association using `create-vpc-association-authorization`.

Associate the target VPCs with the PHZ from the consumer accounts.

The Development VPC and the Shared Services VPC are associated with the `media.internal` PHZ.

The association must be completed by running the `associate-vpc-with-private-hosted-zone` API call from the accounts hosting the respective VPCs (Development and Network accounts).

Configure DNS forwarding from the on-premises network.

On-premises DNS forwarders point queries for `media.internal` to the inbound resolver endpoints in the Shared Services VPC.

Since the PHZ is associated with the Shared Services VPC, the inbound resolver endpoint residing in that VPC can successfully resolve names within `media.internal` for on-premises clients.

Anahtar Kavram

Cross-account Private Hosted Zone (PHZ) association and Route 53 Resolver inbound endpoints are required to facilitate hybrid and multi-account DNS resolution without sharing zones via AWS RAM or routing traffic to link-local IP addresses.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru