A global company has a multi-account AWS environment with spoke VPCs distributed across us-east-1 and us-west-2. The company is designing a hybrid network architecture to connect these VPCs to an on-premises data center with a redundant AWS Direct Connect (DX) infrastructure. The solution must allow spoke VPCs to communicate with the data center and with each other across regions. Additionally, all VPCs must resolve private DNS names hosted on-premises and in a centralized AWS Route 53 Private Hosted Zone (PHZ) in a shared services account, while outbound internet traffic must be routed through centralized NAT Gateways to minimize costs while maintaining high availability. Which architecture meets these requirements with the least administrative overhead and maintains high availability?
- Deploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. In the shared services account, associate the Route 53 Private Hosted Zone (PHZ) with the spoke VPCs in both regions, and deploy centralized Route 53 Resolver outbound endpoints to forward on-premises queries. In each region, deploy redundant NAT Gateways across multiple Availability Zones in a dedicated egress VPC attached to the TGW, routing all outbound traffic () from the spoke VPCs to the egress VPC.Answer
- BConnect the spoke VPCs in each region directly to a centralized Direct Connect Gateway (DXGW) using Private Virtual Interfaces (VIFs) to enable transitive routing between the VPCs and to the on-premises data center. Associate the centralized PHZ with the DXGW to enable DNS resolution across all accounts. Deploy a single NAT Gateway in the shared services VPC in the primary region to handle all egress traffic for both regions.
- CDeploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. Create a duplicate Route 53 PHZ in each individual spoke AWS account to avoid cross-account VPC associations, and configure Route 53 Resolver outbound endpoints in each spoke VPC to resolve on-premises domains. In each region, deploy redundant NAT Gateways across multiple Availability Zones in a dedicated egress VPC attached to the TGW, routing all outbound traffic () from the spoke VPCs to the egress VPC.
- DDeploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. In the shared services account, associate the Route 53 Private Hosted Zone (PHZ) with the spoke VPCs in both regions, and deploy centralized Route 53 Resolver outbound endpoints to forward on-premises queries. In each region, deploy a single NAT Gateway in a single Availability Zone within a dedicated egress VPC attached to the TGW, routing all outbound traffic () from the spoke VPCs to the egress VPC to reduce NAT Gateway costs.
Answer
Deploy regional Transit Gateways (TGWs) peered together, associate them with a Direct Connect Gateway (DXGW) via a Transit VIF, associate the centralized Private Hosted Zone (PHZ) with all spoke VPCs, utilize shared Route 53 Resolver outbound endpoints, and route egress traffic through dedicated egress VPCs with redundant NAT Gateways in each region.
The architecture that peers regional Transit Gateways (TGWs) and associates them with a Direct Connect Gateway (DXGW) via a Transit VIF provides multi-region, multi-account hybrid connectivity with minimal VIF management. Centralizing Route 53 Resolver outbound endpoints in a shared services account and sharing the forwarding rules via AWS Resource Access Manager (RAM) to the spoke VPCs is the most cost-effective and operationally efficient way to resolve on-premises DNS names. Cross-account association of the Route 53 Private Hosted Zone (PHZ) enables all VPCs to resolve internal AWS domains without duplicating hosted zones. Finally, placing redundant NAT Gateways across multiple Availability Zones in dedicated egress VPCs ensures high availability for outbound traffic while centralizing egress management.
Step-by-Step Solution
Key Concept
Multi-region hybrid network integration using AWS Transit Gateway, Direct Connect Gateway, cross-account Route 53 Resolver endpoints, and centralized egress VPCs.
Estimated Time:2m 0s