A financial services corporation is designing a new payment processing system across two A… — AWS Certified Solutions Architect - Professional

A financial services corporation is designing a new payment processing system across two AWS regions: `us-east-1` (Primary) and `us-west-2` (Secondary). In each region, they have deployed a production VPC (`VPC-Prod-US1` and `VPC-Prod-US2` respectively) and a shared services VPC (`VPC-Shared-US1` and `VPC-Shared-US2`). The company has two on-premises data centers connected to AWS via separate $10\text{ Gbps}$ AWS Direct Connect connections terminating at different Direct Connect locations.

The architecture must satisfy the following design constraints:
1. Production VPCs in both regions must communicate with each other privately with low latency and high throughput.
2. Both on-premises data centers must have redundant, dynamically routed network paths to reach VPCs in both AWS regions.
3. Applications in the production VPCs must resolve private DNS names in a Route 53 Private Hosted Zone (PHZ) hosted in `VPC-Shared-US1`, as well as on-premises DNS records.
4. Outbound internet traffic from `VPC-Prod-US1` must be centralized through `VPC-Shared-US1` for security inspection, ensuring no single point of failure across Availability Zones.

Which of the following configurations should the solutions architect implement to meet all requirements?

A
Deploy an AWS Transit Gateway (TGW) in each region (TGW-US1 and TGW-US2) and peer them. Associate local VPCs with their respective TGWs. Associate a Direct Connect Gateway (DXGW) with TGW-US1 and TGW-US2. To resolve private DNS records, configure a Route 53 Resolver Inbound Endpoint in VPC-Shared-US1 and an Outbound Endpoint in VPC-Shared-US2, relying on the peered TGW paths to implicitly resolve hostnames in the Private Hosted Zone (PHZ) associated with VPC-Shared-US1. Deploy redundant NAT Gateways across multiple Availability Zones in VPC-Shared-US1, routing outbound VPC-Prod-US1 traffic through TGW-US1 to these NAT Gateways.
B
Deploy an AWS Transit Gateway (TGW) in each region (TGW-US1 and TGW-US2) and peer them. Associate local VPCs with their respective TGWs. Associate a Direct Connect Gateway (DXGW) with TGW-US1 and TGW-US2. For DNS resolution, create cross-account VPC association authorizations to associate the Shared VPC's Private Hosted Zone (PHZ) with VPC-Prod-US1 and VPC-Prod-US2, and share Route 53 Resolver Outbound rules via AWS RAM. Deploy a single NAT Gateway in VPC-Shared-US1's primary Availability Zone to minimize ongoing NAT processing costs, and configure VPC-Prod-US1 route tables in all Availability Zones to route outbound internet traffic through TGW-US1 to this single NAT Gateway.
Deploy an AWS Transit Gateway (TGW) in each region (TGW-US1 and TGW-US2) and peer them. Associate local VPCs with their respective TGWs. Associate a Direct Connect Gateway (DXGW) with TGW-US1 and TGW-US2. Create cross-account VPC association authorizations to associate the Private Hosted Zone (PHZ) owned by VPC-Shared-US1 with VPC-Prod-US1 and VPC-Prod-US2. Set up Route 53 Resolver Outbound Endpoints in the Shared VPCs to forward on-premises DNS queries, and share the rules with the Production VPCs using AWS Resource Access Manager (RAM). Deploy redundant NAT Gateways across multiple Availability Zones in VPC-Shared-US1, and route outbound VPC-Prod-US1 traffic through TGW-US1 to these NAT Gateways.Answer
D
Deploy a Direct Connect Gateway (DXGW) and associate it directly with VPC-Prod-US1, VPC-Shared-US1, VPC-Prod-US2, and VPC-Shared-US2 to handle hybrid routing. Connect VPC-Prod-US1 and VPC-Prod-US2 via an Inter-Region VPC Peering connection to facilitate cross-region communication. Create cross-account VPC association authorizations to associate the PHZ owned by VPC-Shared-US1 with all VPCs. Set up Route 53 Resolver Inbound Endpoints in VPC-Shared-US1 to handle all outbound on-premises DNS resolution, and deploy a single NAT Gateway in VPC-Shared-US1 to handle egress traffic routed over the VPC peering connection.

Answer

The correct configuration is to deploy Transit Gateways in both regions, peer them, and associate them with a Direct Connect Gateway for hybrid routing. Explicitly associate the Private Hosted Zone with the production VPCs using cross-account authorizations, deploy Route 53 Resolver Outbound Endpoints shared via AWS Resource Access Manager, and deploy redundant NAT Gateways across multiple Availability Zones in the shared services VPC for centralized egress.

The correct configuration utilizes peered AWS Transit Gateways across regions to connect the VPCs, and associates them with a Direct Connect Gateway for hybrid connectivity. For DNS resolution, it correctly uses cross-account VPC association authorizations to associate the Private Hosted Zone with the production VPCs in both regions, allowing them to resolve internal names. It also deploys Route 53 Resolver Outbound Endpoints in the shared VPCs and shares forwarding rules via AWS RAM to resolve on-premises records. Finally, to ensure high availability for outbound traffic without a single point of failure, it deploys redundant NAT Gateways across multiple Availability Zones in the shared services VPC and routes internet-bound traffic through the Transit Gateway to those NAT Gateways.

Step-by-Step Solution

Configure hybrid and inter-region network routing.

Transit Gateways are peered between regions, local VPCs are attached to local Transit Gateways, and a Direct Connect Gateway is associated with both Transit Gateways to provide redundant path routing via BGP.

This satisfies the requirements for private, high-throughput, low-latency communication between the regions and provides redundant hybrid paths to on-premises data centers.

Set up DNS resolution for the Private Hosted Zone (PHZ).

Use cross-account VPC association authorizations from the shared services account to authorize and associate the PHZ with the production VPCs in both regions.

VPCs cannot resolve records in a PHZ unless the PHZ is explicitly associated with them. Peering or Transit Gateway connectivity does not propagate DNS resolution transitively.

Configure hybrid DNS query forwarding.

Deploy Route 53 Resolver Outbound Endpoints in the Shared VPCs, configure forwarding rules pointing to on-premises DNS servers, and share the rules using AWS Resource Access Manager (RAM).

This allows production VPCs to resolve on-premises domain names through the outbound endpoints via the Direct Connect paths.

Implement resilient centralized egress.

Deploy a NAT Gateway in each Availability Zone of VPC-Shared-US1. Point the route tables of VPC-Prod-US1 to route internet traffic to TGW-US1, which routes it to VPC-Shared-US1, where it is routed to the zone-local NAT Gateways.

This ensures that egress internet traffic is inspected centrally and remains highly available without a single point of failure in any single Availability Zone.

Key Concept

Multi-region hybrid networking design combining Transit Gateway peering, Direct Connect Gateway routing, cross-account Route 53 Private Hosted Zone association, and highly available centralized NAT gateway routing.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic