Question

A company operates 40 VPCs across 15 accounts in an AWS Organization. They deploy a pair of Route 53 Resolver outbound endpoints in a central networking account, along with forwarding rules that send queries for 'corp.internal' to on-premises DNS servers. Network engineers must ensure that all 40 VPCs resolve 'corp.internal' names using these forwarding rules, while minimizing operational overhead and avoiding duplication of resolver endpoints in every account. What is the MOST efficient way to achieve this?

Accepted Answer

Share the Resolver forwarding rules from the networking account via AWS Resource Access Manager (RAM), then associate the shared rules with each VPC in the member accounts.

Answer

Create duplicate outbound Resolver endpoints and forwarding rules in each of the 15 accounts and associate them with the local VPCs.

Answer

Peer all 40 VPCs to the networking account VPC and rely on the default VPC DNS resolver to forward queries automatically across the peering connections.

Answer

Configure a Route 53 private hosted zone for 'corp.internal' in the networking account and share it with all VPCs via RAM.