A healthcare enterprise is migrating its legacy systems to AWS. The architecture consists of an AWS Organization with a Shared Services VPC in Account A and an Application VPC in Account B. Both VPCs are connected to the on-premises data center via an AWS Transit Gateway and AWS Direct Connect. In Account A, a Route 53 Private Hosted Zone (PHZ) for corp.internal is hosted. The on-premises DNS servers manage the onprem.internal domain. The company needs to establish a DNS resolution strategy where:
1. Resources in the Application VPC can resolve names in corp.internal.
2. On-premises servers can resolve names in corp.internal.
3. Resources in both VPCs can resolve names in onprem.internal.
Which DNS architecture strategy should a Solutions Architect implement to meet these requirements?
- AIn Account A, share the corp.internal Private Hosted Zone with Account B using AWS Resource Access Manager (RAM). In Account B, accept the share and associate the zone with the Application VPC. Deploy Route 53 Resolver inbound endpoints in Account A's VPC and configure on-premises DNS servers to forward corp.internal queries to the inbound endpoints. Create a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers and associate it directly with both VPCs.
- In Account A, submit a cross-account Private Hosted Zone association authorization for Account B's VPC, and then associate the VPC with the corp.internal zone in Account B. Create Route 53 Resolver inbound and outbound endpoints in Account A's VPC. Create a Route 53 Resolver forwarding rule for onprem.internal pointing to on-premises DNS servers, share this rule with Account B using AWS Resource Access Manager, and associate the rule with the VPCs in both accounts. Configure on-premises DNS servers to forward queries for corp.internal to the inbound endpoint IP addresses.Cevap
- CIn Account A, authorize the cross-account association of corp.internal with Account B's VPC, and complete the association. Configure a Transit Gateway Route Table to route DNS traffic directed to the VPC local DNS resolver () from Account B and on-premises directly to Account A's VPC. Deploy a single Route 53 Resolver outbound endpoint in Account A's VPC and configure a forwarding rule for onprem.internal pointing to the on-premises DNS servers.
- DIn Account A, associate the corp.internal Private Hosted Zone directly with Account B's VPC from the Route 53 console. Create Route 53 Resolver outbound endpoints in both Account A and Account B VPCs. Create forwarding rules for corp.internal in each account pointing to the on-premises DNS servers, and configure the on-premises DNS servers to forward onprem.internal queries to the Route 53 Resolver outbound endpoints.