An enterprise is designing a new multi-VPC AWS architecture in the `us-east-1` Region. The architecture consists of a production VPC (`vpc-prod-us-1` with CIDR ) and a shared services VPC (`vpc-shared-us-1` with CIDR ). Both VPCs are deployed across two Availability Zones (`us-east-1a` and `us-east-1b`). The enterprise needs to connect this AWS environment to an on-premises datacenter using an AWS Direct Connect (DX) connection.
The network design must satisfy the following requirements:
- Enable secure, private bidirectional communication between the on-premises datacenter and both VPCs.
- Enable the production VPC to resolve hostnames in the on-premises DNS zone (`corp.internal`), and enable on-premises hosts to resolve hostnames in a Route 53 Private Hosted Zone (PHZ) for `shared.aws` associated with the shared services VPC.
- Enable high availability for outbound internet traffic from private subnets in `vpc-prod-us-1` such that an outage in a single Availability Zone does not impact internet egress from the remaining Availability Zone.
- Maintain routing isolation between `vpc-prod-us-1` and `vpc-shared-us-1` for VPC-to-VPC traffic, allowing traffic only to and from the datacenter.
Which of the following designs meets these requirements with the least operational complexity?
- ADeploy an AWS Direct Connect Gateway (DXGW) and associate it directly with Virtual Private Gateways (VGWs) attached to `vpc-prod-us-1` and `vpc-shared-us-1` using Private Virtual Interfaces (Private VIFs). To achieve VPC-to-VPC routing isolation on AWS, configure the on-premises router to hair-pin and transitively route traffic between the two VPCs. Associate the Route 53 Private Hosted Zone (PHZ) for `shared.aws` with both VPCs. In `vpc-shared-us-1`, deploy Route 53 Resolver Inbound and Outbound Endpoints across both Availability Zones, and configure a forwarding rule for `corp.internal` associated with both VPCs. In `vpc-prod-us-1`, deploy a NAT Gateway in a public subnet in `us-east-1a` and another in `us-east-1b` for redundant egress.
- BDeploy an AWS Transit Gateway (`tgw-us-east-1`) and associate it with an AWS Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF). Attach both VPCs to the Transit Gateway and configure separate Transit Gateway route tables to isolate VPC-to-VPC traffic. Associate the Route 53 PHZ for `shared.aws` only with `vpc-shared-us-1`. In `vpc-shared-us-1`, deploy Route 53 Resolver Inbound and Outbound Endpoints across both Availability Zones, and configure a Route 53 Resolver forwarding rule for `corp.internal` associated with both VPCs. In `vpc-prod-us-1`, deploy a single NAT Gateway in a public subnet in `us-east-1a`, and configure the private subnet route tables in both `us-east-1a` and `us-east-1b` to route all internet-bound traffic to this single NAT Gateway.
- Deploy an AWS Transit Gateway (`tgw-us-east-1`) and associate it with an AWS Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF). Attach `vpc-prod-us-1` and `vpc-shared-us-1` to the Transit Gateway. Configure separate Transit Gateway route tables for the VPC attachments and the DXGW association, ensuring VPC-to-VPC route propagation is disabled to maintain isolation. Associate the Route 53 Private Hosted Zone (PHZ) for `shared.aws` with both `vpc-prod-us-1` and `vpc-shared-us-1`. In `vpc-shared-us-1`, deploy Route 53 Resolver Inbound and Outbound Endpoints across both Availability Zones. Configure a Route 53 Resolver forwarding rule for `corp.internal` pointing to on-premises DNS servers, and associate this rule with both VPCs. In `vpc-prod-us-1`, deploy a NAT Gateway in a public subnet in `us-east-1a` and another in `us-east-1b`, and configure the private subnet route tables to route internet-bound traffic to the local NAT Gateway in their respective Availability Zone.Answer
- DDeploy an AWS Transit Gateway (`tgw-us-east-1`) and associate it with an AWS Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF). Attach both VPCs to the Transit Gateway and configure separate Transit Gateway route tables to isolate VPC-to-VPC traffic. Associate the Route 53 PHZ for `shared.aws` only with `vpc-shared-us-1`. In `vpc-shared-us-1`, deploy Route 53 Resolver Inbound and Outbound Endpoints across both Availability Zones. Configure a Route 53 Resolver forwarding rule for `corp.internal` pointing to on-premises DNS servers, and associate this rule with both VPCs. In `vpc-prod-us-1`, deploy a NAT Gateway in a public subnet in `us-east-1a` and another in `us-east-1b`, and configure the private subnet route tables to route internet-bound traffic to the local NAT Gateway in their respective Availability Zone.