A healthcare company is preparing to launch a suite of critical applications in the ap-southeast-1 region across three distinct VPCs: vpc-clinical-app, vpc-billing-app, and vpc-core-services. The company requires local DNS resolution for a private hosted zone (PHZ) named corp.internal across all three VPCs. The application servers in vpc-clinical-app and vpc-billing-app must access external regulatory endpoints over the internet, and all resources must connect to an on-premises EHR (Electronic Health Record) system over a 10 Gbps AWS Direct Connect connection. The architecture must minimize latency, avoid transitive routing issues, ensure high availability for outbound egress, and prevent DNS resolution failures. Which architecture meets these requirements with the lowest operational overhead?
- Deploy a Transit Gateway attached to all three VPCs. Connect a Direct Connect Gateway to the Transit Gateway using a transit virtual interface for hybrid connectivity. Create a central egress VPC with public and private subnets across two Availability Zones, hosting a NAT Gateway in each of the two public subnets. Configure the Transit Gateway route tables to route all internet-bound traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone with all three VPCs, and deploy Route 53 Inbound Resolver endpoints in two Availability Zones of the core services VPC to accept DNS queries forwarded from the on-premises DNS servers.Answer
- BDeploy a Transit Gateway attached to all three VPCs. Connect a Direct Connect Gateway to the Transit Gateway using a transit virtual interface for hybrid connectivity. Create a central egress VPC containing public and private subnets, and host one NAT Gateway in the public subnet to centralize outbound traffic. Configure the Transit Gateway route tables to route all internet-bound traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone with all three VPCs, and deploy Route 53 Inbound Resolver endpoints in two Availability Zones of the core services VPC to accept DNS queries forwarded from the on-premises DNS servers.
- CDeploy a Transit Gateway attached to all three VPCs. Connect a Direct Connect Gateway to the Transit Gateway using a transit virtual interface for hybrid connectivity. Create a central egress VPC with public and private subnets across two Availability Zones, hosting a NAT Gateway in each of the two public subnets. Configure the Transit Gateway route tables to route all internet-bound traffic from the spoke VPCs to the egress VPC. Link the private hosted zone only to the core services VPC, and deploy Route 53 Inbound Resolver endpoints in two Availability Zones of the core services VPC to accept DNS queries forwarded from the on-premises DNS servers.
- DConnect a Direct Connect Gateway directly to all three VPCs using private virtual interfaces to handle on-premises and inter-VPC routing. Deploy a separate NAT Gateway inside a public subnet within each individual spoke VPC for local egress. Associate the private hosted zone with all three VPCs, and deploy Route 53 Inbound Resolver endpoints in two Availability Zones of the core services VPC to accept DNS queries forwarded from the on-premises DNS servers.
Answer
The correct architecture uses AWS Transit Gateway associated with a Direct Connect Gateway via a transit virtual interface to handle hybrid and inter-VPC traffic. Highly available internet egress is achieved by using a central egress VPC with public subnets across two Availability Zones, each hosting a NAT Gateway. Private DNS resolution is configured by associating the Route 53 Private Hosted Zone with all three VPCs, and deploying Route 53 Inbound Resolver endpoints across two Availability Zones in the core services VPC to resolve queries from on-premises DNS servers.
Associating the private hosted zone with all three VPCs ensures that resource records can be resolved locally within each VPC. Deploying Route 53 Inbound Resolver endpoints across two Availability Zones in the core services VPC allows on-premises DNS servers to forward queries for the private hosted zone to highly available endpoints. Using a Transit Gateway connected to the Direct Connect Gateway via a transit virtual interface enables multi-VPC hybrid connectivity and inter-VPC routing without transitive limitations. Finally, hosting a NAT Gateway in each of the two public subnets within the central egress VPC ensures that internet-bound traffic from the spoke VPCs remains highly available and does not have a single point of failure.
Step-by-Step Solution
Key Concept
Multi-VPC hybrid routing with Transit Gateway, high availability egress design, and cross-VPC Private Hosted Zone association with Route 53 Resolver endpoints.