A manufacturing company is migrating its legacy ERP inventory management servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The replication traffic must travel privately over an existing AWS Direct Connect connection terminated at an AWS Transit Gateway. The target architecture spans multiple Availability Zones in the staging area VPC and target production VPC. The Solutions Architect must design a highly available replication architecture that ensures private data transfer and proper DNS resolution for the MGN endpoints. Which of the following designs represents the correct setup to allow private replication and meet high availability requirements?
- AConfigure the MGN replication template to use private IP routing. Open TCP port 443 in the staging area security groups to allow agent-to-service communication over SSL/TLS, but block TCP port 1500 to restrict unencrypted replication data from traversing the network, relying on the replication agent to tunnel all data blocks over HTTPS.
- BConfigure the MGN replication template to use private IP routing. Set up the Route 53 Private Hosted Zone for the MGN interface endpoints in a central shared services VPC, and rely on Transit Gateway route tables to resolve the DNS queries without associating the hosted zone with the staging area or target VPCs.
- Configure the MGN replication template to route data replication traffic privately over the Direct Connect connection using the Transit Gateway. Associate the Route 53 Private Hosted Zone containing the MGN endpoints with both the staging area VPC and target VPC. Provision independent NAT Gateways in each Availability Zone of the staging area VPC to handle outbound public traffic, and permit inbound traffic from the on-premises network to the replication servers on TCP port 1500 at the staging VPC level.Answer
- DConfigure the MGN replication template to route replication traffic privately over the Direct Connect connection. To optimize resource utilization and costs within the multi-AZ staging area VPC, configure the route tables of all private subnets to point to a single NAT Gateway deployed in a single public subnet.
Answer
Configure the MGN replication template to route data replication traffic privately over the Direct Connect connection using the Transit Gateway. Associate the Route 53 Private Hosted Zone containing the MGN endpoints with both the staging area VPC and target VPC. Provision independent NAT Gateways in each Availability Zone of the staging area VPC to handle outbound public traffic, and permit inbound traffic from the on-premises network to the replication servers on TCP port 1500 at the staging VPC level.
The correct architecture requires configuring MGN to route traffic privately over Direct Connect via the Transit Gateway, ensuring TCP port 1500 is open in the security groups, associating the Private Hosted Zone with all VPCs to resolve the service endpoints, and deploying redundant NAT Gateways across multiple Availability Zones to ensure high availability.
Step-by-Step Solution
Key Concept
Establishing secure, private, and highly available hybrid replication pathways for AWS Application Migration Service (MGN) using Transit Gateway, interface endpoints, and Route 53 Private Hosted Zones.