Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

An HR-tech SaaS company is deploying a multi-account AWS architecture managed under AWS Organizations. A central `Network-Hub` account hosts a Transit Gateway (TGW) and a shared services VPC. Several consumer VPCs reside in separate production and development accounts, all connected to the TGW. The company maintains an on-premises Active Directory DNS server (10.100.10.1010.100.10.10) in their local datacenter, which is connected to the TGW via an AWS Direct Connect connection. The architecture requires a hybrid DNS resolution strategy where:

1. EC2 instances in the consumer VPCs must resolve internal on-premises domains (`corp.local`).
2. On-premises servers must resolve AWS private domains (`aws.payroll.internal`) hosted in a Route 53 Private Hosted Zone (PHZ) in the `Network-Hub` account.

Which of the following architectures meets these DNS resolution requirements with the least administrative overhead?

  1. Create Route 53 Resolver inbound and outbound endpoints in the shared services VPC. Associate the `aws.payroll.internal` PHZ with the shared services VPC. Create an outbound resolver rule for `corp.local` forwarding to 10.100.10.1010.100.10.10, associate it with the shared services VPC, and share the rule with the consumer accounts using AWS Resource Access Manager (RAM). In the `Network-Hub` account, authorize the association of the consumer VPCs with the PHZ. In the consumer accounts, associate the consumer VPCs with the PHZ and with the shared resolver rule.Cevap
  2. B
    Create Route 53 Resolver inbound and outbound endpoints in the shared services VPC. Associate the `aws.payroll.internal` PHZ with the shared services VPC. Share the PHZ with the consumer accounts using AWS Resource Access Manager (RAM) to automatically enable DNS resolution in all VPCs. Create an outbound resolver rule for `corp.local` forwarding to 10.100.10.1010.100.10.10, and associate it directly with the Transit Gateway to apply it globally across all connected VPCs.
  3. C
    Create a Route 53 Resolver outbound endpoint in the shared services VPC. Create an outbound resolver rule for `corp.local` forwarding to 10.100.10.1010.100.10.10, and share it with the consumer accounts using AWS Resource Access Manager (RAM). For on-premises query resolution of the `aws.payroll.internal` zone, configure the Transit Gateway to route DNS traffic directed to 169.254.169.253169.254.169.253 over the Direct Connect connection to the on-premises environment.
  4. D
    Create Route 53 Resolver inbound and outbound endpoints in the shared services VPC. Associate the `aws.payroll.internal` PHZ with the shared services VPC. Create an outbound resolver rule for `corp.local` forwarding to 10.100.10.1010.100.10.10, and share it with the consumer accounts using AWS Resource Access Manager (RAM). In the `Network-Hub` account, create an outbound resolver rule for `aws.payroll.internal` pointing to the inbound endpoint IP addresses, and share it with the consumer accounts via AWS RAM instead of associating the PHZ with each consumer VPC.

Cevap

Create Route 53 Resolver inbound and outbound endpoints in the shared services VPC, associate the Private Hosted Zone with the shared services VPC, share the outbound rule via AWS RAM, and authorize/associate the Private Hosted Zone across accounts to the consumer VPCs.
The correct architecture uses Route 53 Resolver inbound endpoints to receive on-premises queries, outbound endpoints to forward queries to on-premises, and shares the outbound resolver rules via AWS Resource Access Manager (RAM) for cross-account availability. For private hosted zone resolution, the private hosted zone is associated with the shared services VPC (so the inbound endpoint can resolve names) and with the consumer VPCs via cross-account VPC association authorization, allowing all AWS VPCs to perform local, low-latency resolution.

Adım Adım Çözüm

1
Deploy Route 53 Resolver inbound and outbound endpoints in the shared services VPC of the Network-Hub account.
The inbound endpoints receive queries from the on-premises Active Directory DNS server, while the outbound endpoints send queries from AWS to the on-premises DNS server.
This establishes the physical entry and exit points for hybrid DNS traffic between AWS and the on-premises network.
2
Create an outbound Route 53 Resolver rule for the `corp.local` domain pointing to the on-premises DNS server IP (10.100.10.1010.100.10.10). Share this rule with the consumer accounts using AWS Resource Access Manager (RAM) and associate it with the consumer VPCs.
DNS queries for `corp.local` originating from any associated VPC are forwarded to the on-premises DNS server.
VPC instances need a path to forward queries for non-AWS domains to the on-premises DNS infrastructure.
3
Associate the Private Hosted Zone `aws.payroll.internal` with the shared services VPC. Authorize the cross-account association of the consumer VPCs with the PHZ from the Network-Hub account, and then perform the association from each consumer account.
Both the inbound resolver endpoint (in the shared services VPC) and the EC2 instances in the consumer VPCs can resolve `aws.payroll.internal` queries locally.
On-premises queries hitting the inbound endpoint require the hosted zone to be associated with the inbound endpoint's VPC, and consumer instances require local VPC association to resolve the PHZ without hairpinning queries through endpoints.

Anahtar Kavram

Multi-Account and Hybrid DNS routing using Route 53 Resolver Endpoints and cross-account Private Hosted Zone association.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru