A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs. The company has the following DNS resolution requirements: On-premises systems should be able to resolve and connect to cloud.example.com. All VPCs should be able to resolve cloud.example.com. There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway. Which architecture should the company use to meet these requirements with the HIGHEST performance?
Show Answer & Explanation
Correct Answer: A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
Option A is correct because it properly implements hybrid DNS resolution for the requirements. Route 53 Inbound Resolver enables on-premises DNS servers to forward queries for the cloud.example.com domain to Route 53 allowing on-premises systems to resolve private hosted zone records. Associating the private hosted zone with all VPCs ensures that all VPC resources can resolve the domain natively. The inbound resolver provides the highest performance as it is a managed AWS service optimized for DNS resolution over Direct Connect. Attaching all VPCs to the Transit Gateway ensures network connectivity between on-premises and all VPCs. Options B uses EC2 which adds operational overhead and is not as performant as the managed Route 53 service. Option C incorrectly uses an outbound resolver which is for VPC-to-on-premises resolution not on-premises-to-VPC. Option D only associates the private hosted zone to the shared services VPC making it unavailable to other VPCs.