A global aerospace manufacturer is migrating its engineering CAD workloads to a multi-account AWS environment. The infrastructure consists of a centralized Network VPC in a dedicated Network account, connected to the on-premises engineering headquarters in Munich and Seattle via AWS Direct Connect and AWS Transit Gateway. Multiple Spoke VPCs across different AWS accounts host the CAD rendering engines. The manufacturer has a Route 53 Private Hosted Zone (PHZ) named `engineering.internal` managed in a Shared Services account. Workloads in the Spoke VPCs must resolve records in `engineering.internal` and also resolve local on-premises hosts in `corp.local`. Concurrently, Munich and Seattle on-premises workstations must resolve resources in `engineering.internal` over the Direct Connect connections. Which combination of actions should a Solutions Architect recommend to establish a highly resilient, cost-effective DNS resolution strategy?
- AShare the `engineering.internal` Private Hosted Zone with the AWS Organization using AWS Resource Access Manager (RAM), and associate the shared hosted zone with all Spoke VPCs and the central Network VPC. Deploy Route 53 Resolver Inbound Endpoints in the Network VPC across multiple Availability Zones, and configure on-premises DNS to forward queries for `engineering.internal` to these Inbound Endpoint IP addresses. Deploy Route 53 Resolver Outbound Endpoints in the Network VPC, create a forward rule for `corp.local` pointing to the on-premises DNS servers, share this rule via RAM, and associate it with all Spoke VPCs.
- BAuthorize the association of only the Spoke VPCs with the `engineering.internal` Private Hosted Zone (PHZ) from the Shared Services account, then associate them in their respective accounts using the Route 53 API. Deploy Route 53 Resolver Inbound Endpoints in the central Network VPC across multiple Availability Zones, and configure on-premises DNS to forward queries for `engineering.internal` to these Inbound Endpoint IP addresses. Deploy Route 53 Resolver Outbound Endpoints in the central Network VPC, create a forward rule for `corp.local` pointing to the on-premises DNS servers, share this rule via AWS Resource Access Manager (RAM) with the AWS Organization, and associate it with all Spoke VPCs.
- Authorize the association of the central Network VPC and all Spoke VPCs with the `engineering.internal` Private Hosted Zone (PHZ) from the Shared Services account, then associate them in their respective accounts using the Route 53 API. Deploy Route 53 Resolver Inbound Endpoints in the Network VPC across multiple Availability Zones, and configure on-premises DNS to forward queries for `engineering.internal` to these Inbound Endpoint IP addresses. Deploy Route 53 Resolver Outbound Endpoints in the Network VPC, create a forward rule for `corp.local` pointing to the on-premises DNS servers, share this rule via AWS Resource Access Manager (RAM) with the AWS Organization, and associate it with all Spoke VPCs.Cevap
- DAuthorize the association of the central Network VPC and all Spoke VPCs with the `engineering.internal` Private Hosted Zone (PHZ) from the Shared Services account, then associate them in their respective accounts using the Route 53 API. Deploy Route 53 Resolver Inbound Endpoints in the central Network VPC, and configure on-premises DNS to forward queries for `engineering.internal` to these Inbound Endpoint IP addresses. Deploy Route 53 Resolver Outbound Endpoints in each Spoke VPC directly to avoid cross-VPC transit charges, create local forward rules for `corp.local` pointing to the on-premises DNS servers, and route the traffic directly through the Direct Connect Gateway.
Cevap
Authorize the cross-account association of the Private Hosted Zone with both the spoke VPCs and the central Network VPC, deploy inbound endpoints in the Network VPC for on-premises forwarding, and share a centralized outbound forwarding rule via AWS RAM.
The correct solution involves using the Route 53 API to authorize and associate both the Spoke VPCs and the central Network VPC with the private hosted zone in the Shared Services account. Since Private Hosted Zones cannot be shared via AWS RAM, this API-based cross-account association is mandatory. The central Network VPC must be associated because Route 53 Resolver Inbound Endpoints resolve queries based on the PHZs associated with the VPC in which they are deployed. For outbound resolution, a centralized Outbound Resolver Endpoint in the Network VPC with a forward rule shared via RAM with the AWS Organization is the most cost-effective and operationally efficient configuration.
Adım Adım Çözüm
Anahtar Kavram
Centralized Hybrid DNS Architecture with Cross-Account Private Hosted Zone Associations and Shared Resolver Rules
Tahmini Süre:3m 0s