Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

A financial services firm is migrating its transactional applications to a multi-account AWS environment managed via AWS Organizations. The architecture consists of a Shared Services VPC in a central infrastructure account and multiple spoke VPCs in separate member accounts, all interconnected via an AWS Transit Gateway. The firm also maintains an on-premises datacenter connected to the Transit Gateway via an AWS Direct Connect connection. A Private Hosted Zone (PHZ) for `aws.bank.internal` is created in the central infrastructure account. Applications in the spoke VPCs must resolve records in `aws.bank.internal` and on-premises domain names ending in `onprem.bank.internal`. On-premises servers must also be able to resolve records in `aws.bank.internal`. Which of the following configurations should a Solutions Architect recommend to meet these requirements with the least administrative overhead?

  1. Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Create an outbound resolver rule for `onprem.bank.internal` pointing to the on-premises DNS servers, and share it with the spoke accounts using AWS Resource Access Manager. Authorize and associate the `aws.bank.internal` private hosted zone with the spoke VPCs using the Route 53 API.Cevap
  2. B
    Share the `aws.bank.internal` private hosted zone with the spoke accounts using AWS Resource Access Manager (RAM). In each spoke VPC, configure Route 53 Resolver Inbound Endpoints to handle queries for the `onprem.bank.internal` domain, and route on-premises DNS queries directly through the Direct Connect connection.
  3. C
    Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Create an outbound resolver rule for `onprem.bank.internal` pointing to the on-premises DNS servers, and share it with the spoke accounts using AWS Resource Access Manager. Rely on Transit Gateway transitive routing to automatically resolve the `aws.bank.internal` private hosted zone from the spoke VPCs without manual association.
  4. D
    Create Route 53 Resolver Inbound Endpoints in the Shared Services VPC. In each spoke VPC, create Outbound Endpoints with resolver rules for `onprem.bank.internal` pointing to the on-premises DNS servers. Route all DNS traffic directly through a Direct Connect Gateway private virtual interface without utilizing the Transit Gateway for DNS routing.

Cevap

Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC, configure and share the outbound rule for the on-premises domain via AWS RAM, and authorize/associate the Private Hosted Zone with the spoke VPCs using the Route 53 API.
The correct configuration leverages Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC to manage hybrid traffic, shares the outbound forwarding rules across the organization via AWS RAM to minimize configuration overhead, and uses the Route 53 API to establish the required cross-account Private Hosted Zone associations so spoke VPCs can resolve central records.

Adım Adım Çözüm

1
Set up Inbound and Outbound Endpoints in the central Shared Services VPC.
Establishes network paths for DNS queries going into AWS from on-premises (Inbound) and leaving AWS to on-premises (Outbound).
Centralizing endpoints in a single VPC minimizes deployment costs and simplifies security group management.
2
Create a Route 53 Resolver forwarding rule for the `onprem.bank.internal` domain in the Shared Services account and share it with the organization using AWS Resource Access Manager (RAM).
Spoke VPCs can associate with the shared rule to forward queries to the Outbound Endpoint.
Allows all spoke accounts to automatically inherit the DNS forwarding path to the on-premises DNS servers.
3
Submit cross-account private hosted zone association authorizations for each spoke VPC from the Shared Services account, and then accept the associations in the respective spoke accounts using the Route 53 API.
The spoke VPCs can now resolve DNS records defined inside the `aws.bank.internal` Private Hosted Zone.
Private Hosted Zones must be explicitly associated with each VPC that needs to resolve its records, even across accounts.

Anahtar Kavram

Hybrid and multi-account DNS resolution using Route 53 Resolver Endpoints, RAM rule sharing, and cross-account Private Hosted Zone association.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru