ANS-C01 Question 303
Select 2Your organization has multiple AWS accounts managed under a single AWS Organization. You want to centralize DNS management by sharing a Route 53 private hosted zone from the 'Networking' account with specific VPCs in the 'Development' and 'Production' accounts. Which steps should you take to achieve this using AWS Resource Access Manager (RAM)?
- A
Create a private hosted zone in the 'Networking' account and associate it with the VPCs in the 'Development' and 'Production' accounts using AWS RAM.
- B
Share the private hosted zone from the 'Networking' account by creating a resource share in AWS RAM and including the required VPCs.
- C
Enable AWS Organizations integration in AWS RAM for the 'Networking' account to allow cross-account resource sharing.
- D
Manually configure Route 53 DNS resolver endpoints in each account to query the private hosted zone in the 'Networking' account.
- E
Ensure that the VPCs in the 'Development' and 'Production' accounts have DNS resolution and DNS hostnames enabled.
Show answer and explanation
Correct answers: B, E
Explanation
To share a Route 53 private hosted zone across AWS accounts, you must use AWS Resource Access Manager (RAM) to create a resource share and include the desired VPCs from the target accounts. Additionally, DNS resolution and DNS hostnames must be enabled in the target VPCs to allow them to resolve names within the private hosted zone. AWS Organizations integration, while useful for simplifying resource sharing, is not explicitly required for this use case. Manual configuration of DNS resolver endpoints is unnecessary for private hosted zone sharing.
- A. Incorrect.
Incorrect: While a private hosted zone can be created in the 'Networking' account, it cannot directly associate with VPCs in other accounts without using a sharing mechanism like AWS RAM.
- B. Correct.
Correct: AWS RAM must be used to share the private hosted zone by creating a resource share and specifying the VPCs in the 'Development' and 'Production' accounts.
- C. Incorrect.
Incorrect: While AWS Organizations integration can simplify resource sharing, it is not a mandatory step for sharing private hosted zones via AWS RAM.
- D. Incorrect.
Incorrect: Manually configuring Route 53 DNS resolver endpoints is not required for sharing a private hosted zone. This method is used for forwarding DNS queries, not for sharing hosted zones.
- E. Correct.
Correct: DNS resolution and DNS hostnames must be enabled in the VPCs to ensure they can use the private hosted zone for DNS resolution.