A financial services institution manages its multi-account environment on AWS using AWS Organizations. A central Transit Gateway (TGW) in the Net-Services account interconnects all corporate VPCs, and an AWS Direct Connect (DX) connection with a Transit VIF links the TGW to the on-premises datacenter. A central Hub VPC in the Net-Services account handles centralized network services. The institution has recently acquired a fintech startup, which operates in a separate AWS Organization. The startup's application runs in a VPC (`vpc-fintech`) and utilizes a Route 53 Private Hosted Zone (PHZ) for `fintech.internal` in the startup's AWS account. The security and networking requirements are: 1) Bidirectional DNS resolution must be enabled between all AWS VPCs and the on-premises network. 2) The PHZ `fintech.internal` must remain in the startup's account due to strict governance, but must be resolvable by all corporate VPCs and on-premises. 3) No VPC Peering is allowed between the corporate accounts and the startup account; all routing must go through the Transit Gateway. Which DNS architecture strategy should a solutions architect recommend to satisfy these requirements?
- AShare the `fintech.internal` Private Hosted Zone from the startup's account to the organization's accounts using AWS Resource Access Manager (RAM). In the Net-Services account, associate the shared hosted zone with the Hub VPC and other production VPCs. Deploy Route 53 Resolver Inbound Endpoints in the Hub VPC. Create Outbound Resolver Rules for `corp.internal` pointing to the on-premises DNS servers, share them via RAM, and associate them with all VPCs. Configure on-premises DNS forwarders to target the Inbound Endpoint IPs.
- BEstablish a Transit Gateway attachment for `vpc-fintech` to the central Transit Gateway. In the startup's account, associate the `fintech.internal` PHZ with the corporate Hub VPC. Deploy Route 53 Resolver Outbound Endpoints in the Hub VPC, and create Outbound Rules that forward queries for `fintech.internal` to the Route 53 Resolver link-local IP address `` in `vpc-fintech` over the Transit Gateway connection. Configure on-premises DNS servers to route through the Direct Connect Gateway directly to `vpc-fintech` for resolving `fintech.internal` queries.
- Submit a cross-account hosted zone association authorization from the startup's account to associate `fintech.internal` with the corporate Hub VPC and other VPCs, then associate them using the AWS CLI or SDK. Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC. Create Outbound Resolver Rules for the on-premises domain `corp.internal` pointing to the on-premises DNS servers, share them via AWS RAM with all organization accounts, and associate them with all VPCs. Configure on-premises DNS forwarders to point queries for `fintech.internal` to the Hub VPC Inbound Endpoint IPs.Cevap
- DDeploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC and in `vpc-fintech`. Create a Direct Connect Gateway (DXGW) association with `vpc-fintech`'s Virtual Private Gateway (VGW) to route DNS traffic directly. Configure on-premises DNS forwarders to point to the Inbound Endpoint in `vpc-fintech` over a dedicated Private VIF on the DXGW, bypassing the Transit Gateway. Associate the `fintech.internal` PHZ with the DXGW to allow transitive lookup.