ANS-C01 Question 304
Select 2You are tasked with enabling shared access to a Route 53 Private Hosted Zone for multiple AWS accounts in your organization. The solution must ensure minimal operational overhead and utilize AWS-native services. Which steps are required to achieve this?
- A
Use AWS Resource Access Manager (RAM) to share the Private Hosted Zone with the target accounts.
- B
Ensure that the VPCs in the target accounts are associated with the Private Hosted Zone.
- C
Set up a Route 53 Resolver rule in each target account to forward DNS queries to the Private Hosted Zone in the source account.
- D
Manually replicate the DNS records from the Private Hosted Zone to a new Private Hosted Zone in each target account.
- E
Enable cross-account permissions on the Private Hosted Zone directly using IAM policies.
Show answer and explanation
Correct answers: A, B
Explanation
To share a Route 53 Private Hosted Zone across AWS accounts, AWS RAM is used to share the zone with target accounts. Additionally, VPCs in the target accounts must be associated with the Private Hosted Zone to allow DNS resolution. This approach leverages AWS-native services and minimizes operational overhead, avoiding the need for manual replication or complex configurations like Resolver rules.
- A. Correct.
Correct: AWS Resource Access Manager (RAM) is the recommended service for sharing Route 53 Private Hosted Zones across accounts without duplicating resources.
- B. Correct.
Correct: Associating the VPCs in the target accounts with the Private Hosted Zone ensures DNS resolution for resources within those VPCs.
- C. Incorrect.
Incorrect: Route 53 Resolver rules are not required for sharing Private Hosted Zones. Resolver rules are used for forwarding DNS queries to external DNS systems, not for sharing hosted zones.
- D. Incorrect.
Incorrect: Manually replicating DNS records is not required when using AWS RAM for sharing Private Hosted Zones, as it introduces unnecessary complexity.
- E. Incorrect.
Incorrect: There is no mechanism to enable cross-account permissions directly on a Private Hosted Zone using IAM policies.