A pharmaceutical company operates a multi-account AWS environment with 60 spoke VPCs distr… — AWS Certified Solutions Architect - Professional

A pharmaceutical company operates a multi-account AWS environment with $60$ spoke VPCs distributed across the `us-east-1` and `us-west-2` Regions. The on-premises network is connected to AWS via a $10\text{ Gbps}$ AWS Direct Connect connection. The company requires a highly available network architecture that minimizes administrative overhead and meets the following criteria:
1. All outbound internet traffic from the spoke VPCs must be centralized and routed through a cluster of security appliances in a dedicated Transit VPC in each region.
2. Spoke VPCs must resolve DNS queries for on-premises domain names ending in `.corp` via the Direct Connect connection.
3. On-premises hosts must resolve resource records in an AWS Route 53 Private Hosted Zone (PHZ) named `aws.internal`.

Which hybrid and multi-account network architecture should a solutions architect design to satisfy these requirements?

A
Establish VPC peering connections between all $60$ spoke VPCs and the central Transit VPC in each region to route outbound traffic. Create Route 53 Resolver Inbound and Outbound Endpoints in the Transit VPC. Associate the `aws.internal` PHZ with the Transit VPC only, and configure the spoke VPCs to forward all DNS queries to the Transit VPC's inbound resolver IP. Create a Route 53 Resolver forwarding rule for `.corp` pointing to the on-premises DNS servers and associate it with the Transit VPC.
B
Associate the AWS Direct Connect Gateway directly with the virtual private gateways (VGWs) of all $60$ spoke VPCs. Configure a default route of $0.0.0.0/0$ in each spoke VPC's route table pointing to its local VGW to route internet-bound traffic through the on-premises security appliances. Create Route 53 Resolver forwarding rules inside each spoke VPC's Route 53 configuration to resolve `.corp` domains, and configure on-premises DNS to target the default AWS DNS resolver IPs.
Deploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs and the regional Transit VPC to the local TGW. In the TGW route table for the spoke VPCs, configure a static route for $0.0.0.0/0$ pointing to the Transit VPC attachment. Create Route 53 Resolver Inbound and Outbound Endpoints in a centralized network services VPC in each region. Share a Route 53 Resolver forwarding rule for `.corp` pointing to the on-premises DNS servers across the AWS Organization using AWS Resource Access Manager (RAM) and associate it with all VPCs. Associate the `aws.internal` PHZ with all VPCs in both regions, and configure on-premises DNS to forward queries for `aws.internal` to the Inbound Endpoint IP addresses.Answer
D
Deploy a single AWS Transit Gateway in the `us-east-1` Region, and attach all spoke VPCs from both regions to it. Route all outbound internet traffic from all spoke VPCs to a single NAT Gateway located in the Transit VPC of `us-east-1`. Create a Route 53 Resolver Outbound Endpoint in `us-east-1` and configure it to forward all queries to the on-premises DNS. Associate the `aws.internal` PHZ directly with the Transit Gateway to share it with all attached VPCs.

Answer

The correct network design utilizes regional AWS Transit Gateways peered together, with outbound internet traffic directed via a static route for

0.0.0.0/0

to a local Transit VPC in each region. DNS resolution uses Route 53 Resolver Inbound and Outbound Endpoints in a centralized VPC, with the `.corp` forwarding rule shared via AWS Resource Access Manager to all VPCs, and the `aws.internal` Private Hosted Zone associated directly with all VPCs.

The correct architecture uses regional AWS Transit Gateways peered together to scale connectivity to

60

spoke VPCs. Internet egress is centralized locally within each region using a Transit VPC and a static route for

0.0.0.0/0

in the Transit Gateway route table. For DNS, Route 53 Resolver Outbound Endpoints allow forwarding queries for `.corp` to on-premises DNS, and sharing the forwarding rules via AWS Resource Access Manager reduces administrative overhead. Associating the Private Hosted Zone with all VPCs and deploying Inbound Endpoints allows on-premises clients to resolve `aws.internal` names.

Step-by-Step Solution

Evaluate scalability limits for connecting

60

spoke VPCs to the on-premises network.

Determine that VPC Peering is unmanageable at scale and Direct Connect Gateway has a limit of

10

Virtual Private Gateway associations. Regional AWS Transit Gateways peered across regions are required.

To support transitive routing and scale connectivity across multiple accounts and regions without hitting service limits.

Design the egress routing paths for outbound internet traffic.

Create a Transit VPC in each region containing security appliances, attach it to the local Transit Gateway, and configure a static route for

0.0.0.0/0

in the spoke VPC Transit Gateway route table pointing to the Transit VPC attachment.

To centralize and inspect all egress traffic locally in each region, minimizing inter-region data transfer costs.

Architect the DNS resolution path for resolving on-premises domains from AWS.

Create Route 53 Resolver Outbound Endpoints in a shared network services VPC. Configure a forwarding rule for `.corp` pointing to on-premises DNS servers, share the rule via AWS Resource Access Manager, and associate it with all

60

spoke VPCs.

To enable outbound DNS queries from all spoke VPCs to on-premises while minimizing the cost and management of duplicate endpoints.

Architect the DNS resolution path for resolving AWS Private Hosted Zones from on-premises.

Create Route 53 Resolver Inbound Endpoints in the shared network services VPC. Associate the `aws.internal` Private Hosted Zone with all VPCs in both regions, and configure on-premises DNS to forward queries for `aws.internal` to the Inbound Endpoint IPs.

To ensure that on-premises clients can resolve AWS resources in the Private Hosted Zone, and that the hosted zone is associated with all VPCs that require resolution.

Key Concept

Multi-region hybrid network design using peered Transit Gateways with centralized internet egress and Route 53 Resolver architecture.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic