A company has four VPCs across multiple AWS accounts in the same AWS Region. They need to design a network architecture that allows all VPCs to communicate with each other and also connect to their on-premises data center using a single existing AWS Direct Connect connection. Which of the following architectures meets these requirements with the least operational complexity?
- Deploy an AWS Transit Gateway, attach all four VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection.Answer
- BAttach a Virtual Private Gateway to each VPC, associate them all directly with a single Direct Connect Gateway, and configure routing policies on the Direct Connect Gateway to enable VPC-to-VPC communication.
- CEstablish VPC peering connections between all VPCs to handle inter-VPC traffic, and deploy a single NAT Gateway in one VPC to route all traffic to the on-premises data center.
- DCreate a Route 53 Private Hosted Zone for each VPC, associate them across accounts, and configure a public virtual interface on the Direct Connect connection to route all internal VPC-to-VPC traffic.
Answer
Deploy an AWS Transit Gateway, attach all four VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection.
Deploying an AWS Transit Gateway as a central hub allows for transitive routing between all attached VPCs and the on-premises network via a Direct Connect Gateway association. This hub-and-spoke model simplifies routing management, reduces operational overhead, and scales easily as the network grows.
Step-by-Step Solution
Key Concept
AWS Transit Gateway simplifies hybrid and multi-account network topology by acting as a cloud router that supports transitive routing between VPCs and integrates with Direct Connect Gateway.