A global health-technology company is deploying a clinical trial data platform across a multi-account AWS environment managed by AWS Organizations. The architecture consists of a Shared Services VPC, a Production Workload VPC, and a Dev/Test VPC, all interconnected via an AWS Transit Gateway. The Transit Gateway also connects to the company's on-premises legacy clinical database network via an AWS Direct Connect connection with a Transit Virtual Interface (Transit VIF). A Private Hosted Zone (PHZ) named clinical.local is hosted in the Shared Services AWS account.
The company needs to establish a DNS resolution strategy that meets the following requirements:
- On-premises servers must be able to resolve domain names in the clinical.local PHZ.
- EC2 instances in all three VPCs must be able to resolve both clinical.local domains and on-premises domains ending in corp.internal.
- The architecture must minimize operational overhead, contain DNS query costs, and enforce network isolation policies that prevent direct VPC-to-VPC traffic except through approved channels.
Which of the following configurations represents the most architecturally sound and operationally efficient strategy to satisfy these requirements?
- AAssociate the clinical.local PHZ with the Shared Services VPC. Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Create a forward rule for corp.internal pointing to the on-premises DNS servers, and associate it with the Shared Services VPC. For the Production and Dev/Test VPCs, modify their DHCP options sets to set the domain name servers to the IP addresses of the Route 53 Resolver Inbound Endpoints in the Shared Services VPC, and configure Transit Gateway route tables to allow DNS traffic on port 53 to those IPs.
- BIn the Shared Services account, associate the clinical.local PHZ with the Shared Services VPC. Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Share the clinical.local PHZ with the Production and Dev/Test accounts using AWS Resource Access Manager (RAM) to automatically associate the zone with all VPCs. Create a Route 53 Resolver rule for corp.internal pointing to the on-premises DNS servers, associate the rule with the Shared Services VPC, and configure the workloads' DHCP options sets to point to the Inbound Endpoint IP addresses for all DNS resolution.
- In the Shared Services account, associate the clinical.local PHZ with the Shared Services VPC. Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Authorize the association of the clinical.local PHZ with the Production and Dev/Test VPCs from the Shared Services account, and associate them using the Route 53 API in the respective workload accounts. Create a Route 53 Resolver rule for corp.internal pointing to the on-premises DNS servers, associate the rule with all three VPCs, and configure on-premises DNS servers to forward queries for clinical.local to the Inbound Endpoint IP addresses.Cevap
- DIn the Shared Services account, associate the clinical.local PHZ with the Shared Services VPC. Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Set up a Resolver rule for corp.internal pointing to the on-premises DNS servers. Share and associate this rule with all three VPCs. Route all DNS traffic from the workload accounts to the on-premises network by associating a Direct Connect Gateway directly to each workload VPC using private virtual interfaces (Private VIFs) instead of using the Transit Gateway, bypassing the Shared Services VPC entirely for corporate queries.