ANS-C01 Question 306
Select 2You are a network administrator managing DNS services within a multi-account AWS environment. Your organization wants to share a private hosted zone in Route 53 from a central networking account to several application accounts. Which steps should you take to enable this setup using AWS Resource Access Manager (AWS RAM)?
- A
Create a private hosted zone in the central networking account and associate it with the required VPCs in the application accounts using AWS RAM.
- B
Enable sharing of the private hosted zone with the application accounts by creating a resource share in AWS RAM and specifying the application accounts.
- C
Associate the private hosted zone with a VPC in the central networking account and share the VPC with application accounts using AWS RAM.
- D
Ensure all application accounts have Route 53 Resolver endpoints configured to query the private hosted zone in the central networking account.
- E
Create cross-account IAM roles in the application accounts to allow queries to the private hosted zone in the central networking account.
Show answer and explanation
Correct answers: B, D
Explanation
To share a private hosted zone between accounts, you must use AWS RAM to create a resource share for the private hosted zone, granting permissions to the application accounts. Additionally, Route 53 Resolver endpoints must be configured in the application accounts to enable DNS queries to the shared private hosted zone. These steps ensure seamless DNS resolution in a multi-account AWS environment.
- A. Incorrect.
Incorrect: While private hosted zones are associated with VPCs, AWS RAM is used to share the private hosted zone itself, not directly associate it with VPCs in other accounts.
- B. Correct.
Correct: AWS RAM allows sharing of a private hosted zone with other accounts. This is a key step for enabling DNS resolution across multiple accounts.
- C. Incorrect.
Incorrect: Sharing the VPC does not share the private hosted zone. VPC sharing and DNS sharing are separate configurations.
- D. Correct.
Correct: Application accounts need Route 53 Resolver endpoints to query the private hosted zone from the central networking account. This ensures proper DNS resolution.
- E. Incorrect.
Incorrect: IAM roles are not required for querying a private hosted zone. DNS queries rely on Route 53 and the VPC configuration, not IAM permissions.