Examkin

Soru

Zorluk: ZorMulti-Account and Hybrid DNS Architecture Strategy

A health-tech corporation is migrating its legacy pharmacy management system to AWS. The multi-account architecture is managed under AWS Organizations. A central Core Services account hosts a Shared Services VPC, which is connected to an on-premises data center via an AWS Direct Connect connection and an AWS Transit Gateway. The Shared Services VPC contains Route 53 Resolver Inbound and Outbound Endpoints. A Route 53 Private Hosted Zone (PHZ) named pharmacy.internal is created in the Core Services account. The production workloads are deployed in a Production VPC within a separate Production account, connected to the Shared Services VPC via the same Transit Gateway. On-premises clients must be able to resolve records in pharmacy.internal. EC2 instances in the Production VPC must be able to resolve records in pharmacy.internal and on-premises DNS records in the corp.local domain. Which configuration will meet these requirements with the least administrative overhead while ensuring that DNS traffic does not traverse the public internet?

  1. A
    Associate the pharmacy.internal PHZ with the Shared Services VPC. In the Production VPC, create a Route 53 Resolver Outbound rule that forwards all queries for pharmacy.internal to the Inbound Resolver Endpoint IP addresses in the Shared Services VPC. Configure on-premises DNS servers to forward queries for pharmacy.internal to the same Inbound Resolver Endpoint IPs.
  2. In the Core Services account, authorize the association of the pharmacy.internal PHZ with the Production VPC, and then associate the PHZ from the Production account. Configure on-premises DNS servers to forward queries for pharmacy.internal to the Inbound Resolver Endpoint IP addresses in the Shared Services VPC. In the Core Services account, create a Route 53 Resolver Outbound rule for corp.local pointing to the on-premises DNS servers, share this rule with the Production account using AWS Resource Access Manager (RAM), and associate the shared rule with the Production VPC.Cevap
  3. C
    In the Core Services account, share the pharmacy.internal PHZ with the Production account using AWS Resource Access Manager (RAM) to automatically associate it with the Production VPC. Configure on-premises DNS servers to forward queries for pharmacy.internal directly to the Direct Connect Gateway (DXGW) private virtual interface (VIF) IP addresses. In the Production VPC, configure a local Outbound Resolver Endpoint to forward corp.local queries to on-premises.
  4. D
    In the Core Services account, associate the pharmacy.internal PHZ with the Shared Services VPC. Configure the AWS Transit Gateway to route all DNS traffic destined for the 169.254.169.253 Route 53 Resolver IP address from the Production VPC to the Inbound Resolver Endpoint in the Shared Services VPC. Configure on-premises DNS servers to forward queries for pharmacy.internal to the Inbound Resolver Endpoint.

Cevap

In the Core Services account, authorize the association of the private hosted zone with the Production VPC, and then associate the zone from the Production account. Configure on-premises DNS servers to forward queries for the private zone to the Inbound Resolver Endpoint in the Shared Services VPC. Create an Outbound Resolver rule for the on-premises domain in the Core Services account, share it via AWS Resource Access Manager (RAM), and associate it with the Production VPC.
The correct configuration uses cross-account Private Hosted Zone association to allow the Production VPC to resolve the zone. Hybrid resolution is achieved by pointing on-premises DNS forwarders to the Route 53 Resolver Inbound Endpoint in the Shared Services VPC. For outbound resolution to on-premises, a Route 53 Resolver Outbound rule is created centrally in the Core Services account, shared via AWS RAM, and associated with the Production VPC.

Adım Adım Çözüm

1
Authorize the Private Hosted Zone association from the Core Services account to the Production VPC using the AWS CLI or SDK, and then associate the zone from the Production account.
The Production VPC is associated with the pharmacy.internal Private Hosted Zone, enabling native resolution within the VPC.
Cross-account private hosted zone association is required because Private Hosted Zones cannot be directly associated across accounts via the AWS Console or shared via AWS RAM.
2
Configure the on-premises DNS servers to forward queries for the pharmacy.internal domain to the Inbound Resolver Endpoint IP addresses in the Shared Services VPC.
On-premises clients can resolve names in the pharmacy.internal domain over the Direct Connect connection.
The Inbound Resolver Endpoint is associated with the Shared Services VPC, which can resolve the Private Hosted Zone.
3
Create a Route 53 Resolver Outbound rule for corp.local in the Core Services account, pointing to the on-premises DNS servers. Share this rule with the Production account via AWS RAM, and associate it with the Production VPC.
EC2 instances in the Production VPC can resolve on-premises domains using the shared rule and the central Outbound Resolver Endpoint.
Sharing the Outbound Resolver rule avoids the cost and administrative overhead of deploying separate Outbound Resolver Endpoints in every consumer VPC.

Anahtar Kavram

Centralized Hybrid and Cross-Account Route 53 Resolver and Private Hosted Zone Architecture
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru