A company is executing a corporate migration where multiple business units are split into separate AWS accounts, and their on-premises network is connected to AWS. Under strict compliance guidelines, DNS queries for the shared internal domain `corp.local` must remain private. A Route 53 Private Hosted Zone (PHZ) for `corp.local` is hosted in a central Shared Services account. To enable a production VPC in a separate AWS account to resolve domain names in `corp.local` without exposing the records publicly, which configuration is required?
- Authorize the association of the Private Hosted Zone with the production VPC from the Shared Services account, and then associate the production VPC with the Private Hosted Zone from the production account.Cevap
- BShare the Private Hosted Zone with the production account using AWS Resource Access Manager (RAM) to automatically resolve the zone within the production VPC.
- CConfigure a Route 53 Resolver outbound rule in the production VPC to route queries for the zone via a Direct Connect Gateway directly to the Shared Services VPC.
- DRecreate an identical Private Hosted Zone named `corp.local` in the production account and copy the DNS records, as Private Hosted Zones cannot be shared or associated across different AWS accounts.
Cevap
To resolve the Private Hosted Zone in a cross-account VPC, the owner account must authorize the association, and the consumer account must then associate the VPC with the Private Hosted Zone.
The correct approach is to authorize the association of the Private Hosted Zone with the production VPC from the Shared Services account, and then associate the production VPC with the Private Hosted Zone from the production account. This allows the production VPC to resolve queries in the Private Hosted Zone directly.
Adım Adım Çözüm
Anahtar Kavram
Cross-account Private Hosted Zone association in Route 53
Tahmini Süre:2m 0s