A company has two AWS accounts: Account A (Shared Services) and Account B (Production). Account A hosts a Route 53 Private Hosted Zone (PHZ) named corp.internal associated with its own VPC. The company establishes network connectivity between Account A and Account B. A solutions architect needs to enable resources in Account B's VPC to resolve DNS queries for corp.internal. Which approach should the solutions architect take to resolve these queries with the least administrative effort and cost?
- Authorize the cross-account association of Account B's VPC from Account A, and then associate the VPC with the Private Hosted Zone from Account B.Cevap
- BUse AWS Resource Access Manager (RAM) to share the corp.internal Private Hosted Zone from Account A to Account B, allowing Account B's VPC to automatically resolve the domain.
- CCreate a Route 53 Resolver outbound endpoint in Account B and an inbound endpoint in Account A, and configure a forwarding rule in Account B to route queries for corp.internal to the inbound endpoint.
- DEstablish Transit Gateway routing between the VPCs and configure Transit Gateway DNS propagation to automatically advertise the corp.internal hosted zone to Account B's VPC.
Cevap
Authorize the cross-account association of Account B's VPC from Account A, and then associate the VPC with the Private Hosted Zone from Account B.
To resolve a Route 53 Private Hosted Zone (PHZ) in Account A from a VPC in Account B, the architecture requires cross-account association. This is a two-step process: first, the owner of the PHZ (Account A) authorizes the association using the AWS CLI or API. Second, the owner of the VPC (Account B) associates the VPC with the PHZ. This is the most cost-effective and operationally simple method because it avoids deploying Route 53 Resolver endpoints.
Adım Adım Çözüm
Anahtar Kavram
Cross-account Route 53 Private Hosted Zone association requires authorization from the zone owner and association by the VPC owner.