Soru

Zorluk: ZorStrengthening Identity, Access, and Network Security

A financial services organization uses AWS Organizations to manage a multi-account environment. A shared services VPC in a central networking account hosts a Route 53 Private Hosted Zone (PHZ) named `corp.internal` containing records for internal tools. Multiple application VPCs in member accounts need to resolve records in this PHZ. Additionally, the security team requires that all VPCs within the organization block DNS resolution for known malicious domain names to prevent data exfiltration. The solution must be highly available, minimize latency, and automatically apply to any new VPCs created within the organization. Which solution meets these requirements with the least operational overhead?

  1. Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via AWS Resource Access Manager (RAM), and use AWS Firewall Manager to centrally associate it with all VPCs.Cevap
  2. B
    Share the Private Hosted Zone (PHZ) with the AWS Organization using AWS Resource Access Manager (RAM) to allow automatic resolution across all application VPCs. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via RAM, and use AWS Firewall Manager to centrally associate it with all VPCs.
  3. C
    Configure Route 53 Resolver inbound endpoints in the shared services VPC and outbound endpoints in the application VPCs, creating forwarding rules to route DNS queries to the inbound endpoints. Create local Route 53 Resolver DNS Firewall rule groups in each member account, manually associating them with each VPC, and enforce configuration lock-down via Service Control Policies (SCPs).
  4. D
    Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Apply a Service Control Policy (SCP) at the organization root that includes a Deny statement for DNS resolution requests targeting the malicious domain names.

Cevap

Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via AWS Resource Access Manager (RAM), and use AWS Firewall Manager to centrally associate it with all VPCs.
Directly associating the Route 53 Private Hosted Zone (PHZ) with the member VPCs using cross-account authorizations allows the local Route 53 Resolver in each VPC to answer queries directly, ensuring high availability, minimizing latency, and avoiding extra endpoint costs. Using AWS Resource Access Manager (RAM) and AWS Firewall Manager is the correct and automated way to share and centrally apply a Route 53 Resolver DNS Firewall rule group across the entire AWS Organization, automatically protecting new VPCs as they are created.

Adım Adım Çözüm

1
Configure cross-account Route 53 Private Hosted Zone (PHZ) association.
Create association authorizations from the central networking account for each application VPC, and accept the associations in the member accounts. This allows the Route 53 Resolver in each application VPC to resolve the PHZ records locally without traversing transit gateway endpoints.
Direct association provides the lowest latency and highest availability for DNS resolution in a multi-account environment.
2
Automate VPC associations for future accounts.
Deploy an AWS Lambda function triggered by AWS Organizations event patterns (such as CreateAccount or new VPC creation) to automatically authorize and associate the PHZ with new VPCs.
This removes manual operational overhead and ensures compliance for new resources.
3
Create and share the Route 53 Resolver DNS Firewall rule group.
Create the rule group with a domain list containing the blocked malicious domains. Share this rule group with the AWS Organization using AWS Resource Access Manager (RAM).
Centrally managing the list in the networking account ensures consistency and security policy alignment.
4
Associate the DNS Firewall rule group centrally using AWS Firewall Manager.
Configure a Firewall Manager policy that targets all VPCs in the organization and associates the shared DNS Firewall rule group.
Firewall Manager automatically applies the rule group association to any new VPCs created within the targeted OUs or accounts.

Anahtar Kavram

Cross-account DNS architecture and centralized security policy enforcement using Route 53 Resolver DNS Firewall, AWS RAM, and AWS Firewall Manager.
Tahmini Süre:2m 30s
Bu soruyu puanla