A company is designing a new two-tier application in a VPC across two Availability Zones (us-east-1a and us-east-1b). The application servers are located in private subnets and must access the internet to download security patches. Additionally, the application servers must resolve domain names within a Route 53 Private Hosted Zone (corp.internal) hosted in a separate administrative VPC. Which two configuration steps must the Solutions Architect perform to meet these requirements with high availability?
- Deploy a NAT Gateway in the public subnet of each Availability Zone, and configure the route tables of the private subnets to direct internet-bound traffic to the local NAT Gateway in the same Availability Zone.Cevap
- Associate the Route 53 Private Hosted Zone corp.internal with the new application VPC.Cevap
- CDeploy a single NAT Gateway in the public subnet of us-east-1a, and update the route tables of both private subnets to route outbound traffic through this single NAT Gateway.
- DEstablish a Transit Gateway attachment between the two VPCs and rely on Transit Gateway routing to automatically resolve DNS queries for corp.internal from the application VPC.
- ECreate a public Route 53 hosted zone for corp.internal and use IAM policies to restrict resolution to the instances within the application VPC.
Cevap
Deploy a NAT Gateway in the public subnet of each Availability Zone, and associate the Route 53 Private Hosted Zone corp.internal with the application VPC.
Deploying a NAT Gateway in the public subnet of each Availability Zone provides fault tolerance, preventing a single zone outage from disrupting internet access for other zones. Additionally, associating the Route 53 Private Hosted Zone corp.internal with the application VPC is a required step to allow instances in that VPC to resolve the private domain names.
Adım Adım Çözüm
Anahtar Kavram
High availability for outbound VPC traffic and DNS resolution across multiple VPCs using NAT Gateways and Route 53 Private Hosted Zone associations.