Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

A logistics company is designing a hybrid DNS architecture for its AWS multi-account environment. A central Network account manages a Transit Gateway that connects spoke VPCs in multiple member accounts, as well as an on-premises datacenter via an AWS Direct Connect gateway. The on-premises network uses DNS servers that host the domain `onprem.logistics.local`. The company has created a Route 53 Private Hosted Zone (PHZ) for `aws.logistics.local` in a Shared Services AWS account. Spoke VPCs must be able to resolve records in both `aws.logistics.local` and `onprem.logistics.local`, and on-premises servers must be able to resolve records in `aws.logistics.local`. Which combination of actions should a Solutions Architect take to achieve this hybrid DNS resolution? (Select TWO.)

  1. Configure Route 53 Resolver inbound endpoints in the central Network VPC. Configure the on-premises DNS servers to forward queries for the domain `aws.logistics.local` to the IP addresses of these inbound endpoints.Cevap
  2. Authorize the cross-account association of the `aws.logistics.local` Private Hosted Zone from the Shared Services account to the spoke VPCs using the AWS CLI or SDK, and then perform the association from each member account.Cevap
  3. C
    Create a resource share in AWS Resource Access Manager (RAM) to share the `aws.logistics.local` Private Hosted Zone with the AWS Organization, and then accept the share in the member accounts to enable automatic resolution.
  4. D
    Establish a Route 53 Resolver outbound endpoint in each spoke VPC and configure outbound rules pointing to the Direct Connect Gateway's public virtual interface to route DNS queries to the on-premises DNS servers.
  5. E
    Associate the on-premises DNS servers directly with the Transit Gateway route tables using a multicast domain to dynamically broadcast DNS resolution paths to all spoke VPCs.

Cevap

Configure Route 53 Resolver inbound endpoints in the central Network VPC and configure on-premises DNS forwarders to point to them. Additionally, authorize the cross-account association of the Private Hosted Zone from the Shared Services account using the AWS CLI or SDK, and associate the spoke VPCs from the member accounts.
Configuring Route 53 Resolver inbound endpoints in the central Network VPC provides private IP addresses that receive DNS queries from the on-premises network. Configuring on-premises DNS forwarders to point to these IPs enables datacenter hosts to resolve internal AWS domains. Programmatic authorization of cross-account Private Hosted Zone association from the owning Shared Services account, followed by associating the spoke VPCs from the member accounts, allows all spoke VPCs to natively resolve records in the private zone.

Adım Adım Çözüm

1
Configure inbound resolver endpoints in the central Network VPC.
IP addresses are assigned to the inbound endpoints within the private subnet space.
This provides a target destination for the on-premises DNS servers to forward queries for AWS resources.
2
Configure on-premises DNS servers to forward requests for `aws.logistics.local` to the inbound resolver endpoint IPs.
On-premises servers route DNS queries for AWS domains over Direct Connect to AWS.
This establishes outbound DNS resolution from the datacenter to AWS.
3
Authorize the spoke VPCs to associate with the `aws.logistics.local` Private Hosted Zone (PHZ) from the Shared Services account.
The target spoke VPCs in the member accounts are authorized to establish cross-account associations with the PHZ.
VPCs in other member accounts cannot resolve resources in a PHZ owned by another account without explicit cross-account authorization.
4
Associate the spoke VPCs with the authorized PHZ from the member accounts.
Instances in the spoke VPCs can now resolve DNS records within the `aws.logistics.local` zone.
This completes the cross-account PHZ association process.

Anahtar Kavram

Cross-Account Private Hosted Zone Association and Hybrid Route 53 Inbound Resolution
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru