An enterprise is designing a secure hybrid and multi-account network topology using AWS Or… — AWS Certified Solutions Architect - Professional

An enterprise is designing a secure hybrid and multi-account network topology using AWS Organizations. The environment consists of $50$ spoke VPCs distributed across two AWS regions: `us-east-1` and `us-west-2`. The architecture includes an AWS Transit Gateway (TGW) in each region with inter-region peering established, and a Shared Services VPC in a dedicated Infrastructure account. An on-premises data center is connected via AWS Direct Connect to a Direct Connect Gateway associated with both regional TGWs. The enterprise must meet the following requirements:

1. Spoke VPCs in all accounts must resolve domain names in a Private Hosted Zone (PHZ) named ` $internal.aws$ ` hosted in the Shared Services account.
2. Spoke VPCs must forward DNS queries for the domain ` $onprem.corp$ ` to on-premises DNS servers.
3. Outbound internet traffic from all spoke VPCs must be centrally inspected by AWS Network Firewall endpoints deployed across multiple Availability Zones in a centralized Egress VPC in each region.

Which two actions should the solutions architect take to configure the DNS resolution and traffic routing to meet these requirements?

Configure DNS resolution by creating the ` $internal.aws$ ` PHZ in the Shared Services account. Authorize cross-account VPC associations for the spoke VPCs, and accept the associations in the spoke accounts. Create Route 53 Resolver outbound endpoints in the Shared Services VPC, define a forwarding rule for ` $onprem.corp$ ` pointing to on-premises DNS servers, share this rule via AWS Resource Access Manager (RAM) with the organization, and associate the shared rule with all spoke VPCs.Cevap
B
Configure DNS resolution by creating the ` $internal.aws$ ` PHZ in the Shared Services account and sharing it with the organization using AWS Resource Access Manager (RAM). Associate the shared PHZ with the spoke VPCs in each account. Create Route 53 Resolver inbound endpoints in the spoke VPCs to receive and forward queries for ` $onprem.corp$ ` directly to the on-premises DNS servers.
Configure egress routing by deploying regional AWS Network Firewall endpoints, TGW attachments, and NAT Gateways across multiple Availability Zones in the Egress VPC. In the regional TGW route table associated with the spoke VPCs, add a static default route (` $0.0.0.0/0$ `) pointing to the local Egress VPC TGW attachment. In the Egress VPC, configure the TGW subnet route tables to route ` $0.0.0.0/0$ ` to the Network Firewall endpoints, and configure the firewall subnet route tables to route ` $0.0.0.0/0$ ` to the NAT Gateways.Cevap
D
Configure egress routing by deploying a single NAT Gateway and a single AWS Network Firewall endpoint in a centralized subnet within the Egress VPC. In the spoke VPC route tables, add a default route (` $0.0.0.0/0$ `) pointing to the Shared Services VPC, and configure the Shared Services TGW route table to propagate the default route to all spokes.
E
Configure routing by propagating the default route (` $0.0.0.0/0$ `) from the Direct Connect Gateway to both regional TGWs. Configure the TGW route tables to route all internet-bound traffic through the Direct Connect Gateway to the on-premises firewall for inspection, and peer the regional TGWs directly to allow spoke VPCs to access the Shared Services VPC across regions.

Cevap

Configure DNS resolution using cross-account Private Hosted Zone association and Route 53 Resolver forwarding rules shared via AWS RAM. Configure centralized egress routing using multi-AZ AWS Network Firewall endpoints and NAT Gateways with static default routes in the regional Transit Gateway.

The correct solution involves two main architectures. For hybrid DNS resolution, a Private Hosted Zone cannot be shared directly via AWS RAM; instead, it must be associated with the spoke VPCs using cross-account hosted zone association authorization. The Route 53 Resolver forwarding rule for the on-premises domain is shared via AWS RAM and associated with the spoke VPCs to redirect queries to the outbound endpoints. For centralized egress, high availability requires multi-AZ deployment of Network Firewall endpoints and NAT Gateways in the Egress VPC. Spoke traffic is sent to the Egress VPC via TGW default routing, inspected by the local firewall endpoint, and sent to the NAT Gateway.

Adım Adım Çözüm

Set up DNS resolution for the central Private Hosted Zone across accounts.

Authorized cross-account VPC associations are created for the spoke VPCs, enabling them to associate with and resolve queries within the central `

internal.aws

` PHZ.

Private Hosted Zones are not supported by AWS RAM for cross-account sharing, so API-based cross-account association is required.

Configure hybrid DNS forwarding to the on-premises DNS servers.

A Route 53 Resolver forwarding rule is created for the `

onprem.corp

` domain pointing to the on-premises DNS servers, shared via AWS RAM with the organization, and associated with all spoke VPCs.

This allows centralized outbound DNS resolution while minimizing the cost and management of deploying endpoints in every spoke VPC.

Configure high-availability egress routing path in the Egress VPC.

TGW route tables point `

0.0.0.0/0

` to the Egress VPC attachment. Egress VPC TGW subnets route `

0.0.0.0/0

` to the Network Firewall endpoints, which in turn route to the local NAT Gateways.

This guarantees that all outbound internet traffic is inspected by the AWS Network Firewall without creating a single point of failure.

Anahtar Kavram

Centralized network security routing and cross-account hybrid DNS architecture using AWS Transit Gateway and Route 53 Resolvers.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru