A global retail enterprise is designing a multi-account, multi-region AWS network architecture to support its migration. The setup consists of spoke VPCs in the `us-east-1` Region and spoke VPCs in the `us-west-2` Region, all managed under AWS Organizations.
The enterprise has the following requirements:
- Hybrid Connectivity: Connect all spoke VPCs to the on-premises data centers in New York and San Francisco. Two AWS Direct Connect (DX) connections terminate at a Direct Connect Gateway (DXGW) in New York, and two terminate at the same DXGW in San Francisco.
- Failover: Establish AWS Site-to-Site VPN connections over the internet from the on-premises locations to AWS as a backup. The DX path must be preferred for all hybrid traffic, failing over to VPN only during a DX outage.
- Egress Security: Route all outbound internet traffic from both Regions through a dedicated egress VPC in each Region containing transit subnets and NAT Gateways. This must minimize cross-Availability Zone (AZ) data transfer costs and avoid single points of failure.
- DNS Resolution: Allow all spoke VPCs to resolve private domain names in a Route 53 Private Hosted Zone (PHZ) `corp.internal` hosted in a centralized Shared Services account.
- Administrative Overhead: Minimize cost, provisioning complexity, and ongoing management.
Which routing and connectivity design should the Solutions Architect recommend to meet these requirements?
- ADeploy an AWS Transit Gateway (TGW) in each Region and associate both TGWs with the DXGW. Establish Site-to-Site VPN connections from the New York customer gateway to the `us-east-1` TGW, and from the San Francisco customer gateway to the `us-west-2` TGW. Configure BGP on the customer gateways to prefer routes received via DX over VPN using BGP Local Preference. In each Region, deploy a centralized egress VPC with a single NAT Gateway in one AZ to minimize NAT Gateway hourly charges, routing all outbound traffic from all AZs to it. In all spoke VPCs, deploy Route 53 Resolver inbound and outbound endpoints to forward queries to the Shared Services VPC where the `corp.internal` PHZ is associated.
- BDeploy a Virtual Private Gateway (VGW) in each of the spoke VPCs and associate them directly with the DXGW to avoid Transit Gateway processing charges. Route spoke-to-spoke traffic across Regions through the DXGW. Deploy a single NAT Gateway in each Region's central VPC. In each spoke VPC account, create a duplicate Route 53 Private Hosted Zone for `corp.internal` and write a custom automation script to keep records in sync across all accounts.
- Deploy an AWS Transit Gateway (TGW) in each Region and associate both TGWs with the DXGW. Establish Site-to-Site VPN connections from the New York customer gateway to the `us-east-1` TGW, and from the San Francisco customer gateway to the `us-west-2` TGW. Configure BGP on the customer gateways to prefer routes received via DX over VPN using BGP Local Preference. In each Region, deploy a centralized egress VPC with a NAT Gateway in each AZ, attach the egress VPC to the local TGW with appliance mode enabled, and route spoke VPC egress traffic () to the TGW. Create VPC association authorizations for the `corp.internal` PHZ in the Shared Services account and associate the PHZ with the spoke VPCs in all accounts.Answer
- DDeploy an AWS Transit Gateway (TGW) in each Region and associate both TGWs with the DXGW. Establish Site-to-Site VPN connections from the New York customer gateway to the `us-east-1` TGW, and from the San Francisco customer gateway to the `us-west-2` TGW. To ensure failover routing, advertise more specific prefixes (e.g., ) over the VPN connections and summarized prefixes (e.g., ) over the DX connections. Deploy NAT Gateways in each AZ of the egress VPCs. Associate the `corp.internal` PHZ with the Shared Services VPC, set up VPC Peering between the spoke VPCs and the Shared Services VPC, and configure the spoke VPCs to forward DNS queries directly to the AWS-provided DNS server () of the Shared Services VPC.