A multinational retail corporation is designing a new hybrid networking architecture to connect its on-premises inventory systems with three newly created VPCs in the us-east-1 Region: vpc-checkout-prod, vpc-catalog-prod, and vpc-orders-prod. The on-premises data centers are connected to AWS via two active-passive 10 Gbps AWS Direct Connect connections terminating at different Direct Connect locations. The architecture requires that all three VPCs have low-latency, bidirectional communication with each other and can access the on-premises inventory systems. Additionally, workloads in the private subnets of all three VPCs must be able to download external software updates. The solution must ensure high availability for outbound traffic, prevent single points of failure, and minimize both operational complexity and NAT Gateway hourly costs. Which network architecture design meets these requirements?
- Deploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). Create a centralized egress VPC with a NAT Gateway deployed in each of two Availability Zones, attach it to the Transit Gateway, and configure route tables to direct all outbound internet traffic from the application VPCs through the Transit Gateway to the egress VPC.Answer
- BDeploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). To minimize NAT Gateway deployment costs, create a single NAT Gateway in one public subnet within vpc-checkout-prod, and configure the route tables of the other application VPCs to direct all internet-bound traffic to this NAT Gateway via the Transit Gateway.
- CAssociate the three application VPCs directly with a Direct Connect Gateway using Private Virtual Interfaces (Private VIFs) on the Direct Connect connections. Configure the Direct Connect Gateway to route traffic between the application VPCs and to the on-premises data centers. Deploy a NAT Gateway in each Availability Zone of all three VPCs to handle high-availability internet egress.
- DDeploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). Centralize outbound internet egress by deploying a NAT Gateway in each Availability Zone of a shared egress VPC. Host a Route 53 Private Hosted Zone (PHZ) for internal service resolution in a central account, and associate it only with the egress VPC, relying on the Transit Gateway to route DNS queries from the application VPCs.