An automotive manufacturer is establishing a multi-account AWS landing zone. A central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for `factory.internal` associated with the Shared Services VPC. Workloads in a Production VPC in a separate Production account need to resolve domains in `factory.internal`. Additionally, on-premises assembly line systems, connected via AWS Direct Connect and AWS Transit Gateway, must resolve domains in `factory.internal`. Which combination of actions will allow both the Production VPC workloads and the on-premises systems to resolve domains in `factory.internal`?
- In the Shared Services account, authorize the association of the `factory.internal` Private Hosted Zone with the Production VPC. In the Production account, associate the Production VPC with the `factory.internal` Private Hosted Zone. Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `factory.internal` to the Inbound Endpoint IP addresses.Cevap
- BShare the `factory.internal` Private Hosted Zone with the Production account and the on-premises network using AWS Resource Access Manager (RAM). In the Production VPC, accept the resource share. Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `factory.internal` to the Inbound Endpoint IP addresses.
- CRely on the AWS Transit Gateway connection between the Shared Services VPC and the Production VPC to route DNS traffic. Configure the Production VPC's DHCP options set to point to the Route 53 Resolver Inbound Endpoint in the Shared Services VPC. Forward the on-premises DNS queries for `factory.internal` directly to a Route 53 Resolver Outbound Endpoint in the Shared Services VPC.
- DIn the Shared Services account, associate the `factory.internal` Private Hosted Zone with the Production VPC using the Route 53 console. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC, and configure the on-premises DNS servers to route DNS traffic for `factory.internal` over an AWS Direct Connect public virtual interface directly to the Route 53 link-local DNS IP address ().
Cevap
In the Shared Services account, authorize the association of the `factory.internal` Private Hosted Zone with the Production VPC. In the Production account, associate the Production VPC with the `factory.internal` Private Hosted Zone. Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `factory.internal` to the Inbound Endpoint IP addresses.
The correct answer outlines the proper steps for cross-account Private Hosted Zone (PHZ) association and hybrid inbound resolution. Because Route 53 PHZs are account-bound, associating a VPC in another account requires an authorization step from the owner account before the association can be executed in the consumer account. To resolve these DNS records from on-premises, a Route 53 Resolver Inbound Endpoint must be created in a VPC associated with the PHZ. On-premises DNS servers are then configured to forward requests to the Inbound Endpoint's IP addresses.
Adım Adım Çözüm
Anahtar Kavram
Cross-account Private Hosted Zone association requires explicit CLI/API authorization followed by association, while hybrid inbound DNS resolution relies on Route 53 Resolver Inbound Endpoints.