A company is designing a multi-account network architecture on AWS consisting of three spoke VPCs in the us-east-1 region with CIDR blocks , , and . The architecture must support hybrid connectivity to an on-premises data center using an AWS Direct Connect connection. Additionally, all spoke VPCs must route outbound internet traffic through a centralized egress VPC to inspect traffic and control costs. Which of the following network designs meets these requirements with the least operational complexity?
- AAssociate the Virtual Private Gateways (VGWs) of the spoke VPCs and the egress VPC directly with a single AWS Direct Connect Gateway using Private Virtual Interfaces (Private VIFs). Configure the Direct Connect Gateway to route internal inter-VPC traffic and redirect internet-bound traffic through the egress VPC.
- Deploy an AWS Transit Gateway in the region, and attach the spoke VPCs and the egress VPC to it. Associate the Transit Gateway with an AWS Direct Connect Gateway using a Transit Virtual Interface (Transit VIF). Configure the routing tables in the spoke VPCs to direct all internet-bound traffic to the Transit Gateway, and configure the Transit Gateway route table to forward internet-bound traffic to the egress VPC attachment.Answer
- CEstablish a mesh of VPC peering connections between all spoke VPCs and the egress VPC. Deploy a single NAT Gateway in one Availability Zone in the egress VPC, and update all spoke VPC route tables to direct outbound internet traffic through the peering connections to the single NAT Gateway.
- DDeploy an AWS Transit Gateway and attach the spoke VPCs and the egress VPC to it. Associate the Transit Gateway with a Direct Connect Gateway. Create a Route 53 Private Hosted Zone (PHZ) for DNS resolution in the egress VPC, and rely on the Transit Gateway attachments to automatically resolve DNS queries from the spoke VPCs without associating the PHZ with them.
Answer
Deploy an AWS Transit Gateway in the region, and attach the spoke VPCs and the egress VPC to it. Associate the Transit Gateway with an AWS Direct Connect Gateway using a Transit Virtual Interface (Transit VIF). Configure the routing tables in the spoke VPCs to direct all internet-bound traffic to the Transit Gateway, and configure the Transit Gateway route table to forward internet-bound traffic to the egress VPC attachment.
The correct network design leverages AWS Transit Gateway as a centralized hub to connect multiple spoke VPCs and the egress VPC. By associating the Transit Gateway with an AWS Direct Connect Gateway using a Transit Virtual Interface (Transit VIF), the organization achieves hybrid connectivity to the on-premises datacenter. Traffic flow for outbound internet is directed to the Transit Gateway, which routes it transitively to the egress VPC containing the security inspection and NAT services, satisfying all architectural requirements with minimal administrative complexity.
Step-by-Step Solution
Key Concept
Hub-and-spoke transit networking with AWS Transit Gateway and Direct Connect Gateway