A financial services organization uses AWS Organizations to manage a multi-account environment. A shared services VPC in a central networking account hosts a Route 53 Private Hosted Zone (PHZ) named `corp.internal` containing records for internal tools. Multiple application VPCs in member accounts need to resolve records in this PHZ. Additionally, the security team requires that all VPCs within the organization block DNS resolution for known malicious domain names to prevent data exfiltration. The solution must be highly available, minimize latency, and automatically apply to any new VPCs created within the organization. Which solution meets these requirements with the least operational overhead?
- Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via AWS Resource Access Manager (RAM), and use AWS Firewall Manager to centrally associate it with all VPCs.Cevap
- BShare the Private Hosted Zone (PHZ) with the AWS Organization using AWS Resource Access Manager (RAM) to allow automatic resolution across all application VPCs. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via RAM, and use AWS Firewall Manager to centrally associate it with all VPCs.
- CConfigure Route 53 Resolver inbound endpoints in the shared services VPC and outbound endpoints in the application VPCs, creating forwarding rules to route DNS queries to the inbound endpoints. Create local Route 53 Resolver DNS Firewall rule groups in each member account, manually associating them with each VPC, and enforce configuration lock-down via Service Control Policies (SCPs).
- DAssociate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Apply a Service Control Policy (SCP) at the organization root that includes a Deny statement for DNS resolution requests targeting the malicious domain names.
Cevap
Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via AWS Resource Access Manager (RAM), and use AWS Firewall Manager to centrally associate it with all VPCs.
Directly associating the Route 53 Private Hosted Zone (PHZ) with the member VPCs using cross-account authorizations allows the local Route 53 Resolver in each VPC to answer queries directly, ensuring high availability, minimizing latency, and avoiding extra endpoint costs. Using AWS Resource Access Manager (RAM) and AWS Firewall Manager is the correct and automated way to share and centrally apply a Route 53 Resolver DNS Firewall rule group across the entire AWS Organization, automatically protecting new VPCs as they are created.
Adım Adım Çözüm
Anahtar Kavram
Cross-account DNS architecture and centralized security policy enforcement using Route 53 Resolver DNS Firewall, AWS RAM, and AWS Firewall Manager.
Tahmini Süre:2m 30s