An enterprise is building a new IoT-enabled manufacturing platform in the `us-east-1` Regi… — AWS Certified Solutions Architect - Professional

An enterprise is building a new IoT-enabled manufacturing platform in the `us-east-1` Region. The network architecture consists of three VPCs across different AWS accounts within an AWS Organization:

- An application VPC `vpc-factory-prod` ( $172.16.0.0/16$ )
- A logistics VPC `vpc-warehouse-prod` ( $172.17.0.0/16$ )
- A shared services VPC `vpc-shared-core` ( $192.168.0.0/20$ )

All VPCs are interconnected using an AWS Transit Gateway named `tgw-mfg-core` with attachments in two Availability Zones (`us-east-1a` and `us-east-1b`).

The Solutions Architect must meet the following requirements:
1. Provide highly available and fault-tolerant egress-only internet connectivity for private instances in `vpc-factory-prod` and `vpc-warehouse-prod` while minimizing NAT gateway costs by centralizing egress traffic.
2. Allow private instances in the consumer VPCs (`vpc-factory-prod` and `vpc-warehouse-prod`) to resolve private DNS queries for resources hosted in `vpc-shared-core` via a Route 53 Private Hosted Zone (PHZ) named `corp.internal` associated with `vpc-shared-core`.

Which TWO configurations must the Solutions Architect implement to satisfy these networking and connectivity requirements?

Deploy one NAT Gateway in a public subnet in `us-east-1a` and another in `us-east-1b` within `vpc-shared-core`. In `vpc-shared-core`, configure the route tables of the subnets containing the Transit Gateway attachments to direct outbound traffic ( $0.0.0.0/0$ ) to the NAT Gateway in their respective Availability Zone. Point the default route ( $0.0.0.0/0$ ) in the Transit Gateway route table associated with the spoke VPCs to the `vpc-shared-core` attachment.Answer
Submit a VPC association authorization from the AWS account hosting `vpc-shared-core` for the `corp.internal` Private Hosted Zone targeting `vpc-factory-prod` and `vpc-warehouse-prod`. From the spoke accounts, accept the authorizations to associate the hosted zone with the spoke VPCs, and ensure both `enableDnsSupport` and `enableDnsHostnames` are set to true on all three VPCs.Answer
C
Deploy a single NAT Gateway in a public subnet in `us-east-1a` within `vpc-shared-core`. In the Transit Gateway route table associated with the spoke VPCs, configure a default route ( $0.0.0.0/0$ ) pointing to the `vpc-shared-core` attachment to centralize internet egress and minimize billing charges.
D
Configure VPC peering connections between `vpc-factory-prod` and `vpc-shared-core`, and between `vpc-warehouse-prod` and `vpc-shared-core`. Configure the route tables in the spoke VPCs to route internet-bound traffic ( $0.0.0.0/0$ ) through the peering connections to the Internet Gateway attached to `vpc-shared-core`.
E
Establish a Route 53 Resolver outbound endpoint in `vpc-shared-core` and inbound endpoints in `vpc-factory-prod` and `vpc-warehouse-prod`. Create Route 53 forwarding rules in the spoke accounts to forward queries for `corp.internal` to the inbound endpoints.

Answer

Deploying redundant NAT Gateways per Availability Zone in the shared services VPC and routing outbound Transit Gateway traffic to them ensures highly available centralized egress. Performing cross-account Private Hosted Zone association authorizations allows spoke VPCs to resolve internal DNS queries directly.

Deploying one NAT Gateway per Availability Zone in the shared services VPC and routing outbound traffic from the Transit Gateway attachment subnets to the local NAT Gateway provides a fault-tolerant and zone-redundant egress path. For cross-account DNS resolution of a Private Hosted Zone, the owner account must authorize the association, and the spoke accounts must accept it, while ensuring DNS hostnames and support are enabled on all target VPCs.

Step-by-Step Solution

Analyze the egress requirements for the multi-VPC environment.

Identified that spoke VPCs require outbound internet access through the central shared services VPC using AWS Transit Gateway.

Centralizing egress through a shared services VPC reduces the number of public subnets and NAT Gateways required, but high availability must be maintained by deploying NAT Gateways in multiple Availability Zones.

Configure Transit Gateway and central VPC routing for high-availability egress.

Created a default route pointing to the Transit Gateway in the spoke VPC subnets, and configured the central VPC's Transit Gateway attachment subnets to route traffic to local NAT Gateways in their respective Availability Zones.

This keeps traffic within the same Availability Zone to avoid cross-AZ latency and data transfer costs, while avoiding a single point of failure.

Establish cross-account DNS resolution.

Used the AWS CLI or SDK to create a VPC association authorization from the owner account of the Private Hosted Zone, and accepted the association in the consumer spoke accounts.

VPCs in different accounts cannot be directly associated with a Private Hosted Zone via the console; it requires a programmatic two-step authorization and association process.

Key Concept

Centralized egress and cross-account DNS resolution in a multi-account AWS Transit Gateway architecture.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic