A company is designing a new two-tier application in a VPC across two Availability Zones (us-east-1a and us-east-1b). The application servers are located in private subnets and must access the internet to download security patches. Additionally, the application servers must resolve domain names within a Route 53 Private Hosted Zone (corp.internal) hosted in a separate administrative VPC. Which two configuration steps must the Solutions Architect perform to meet these requirements with high availability?
- Deploy a NAT Gateway in the public subnet of each Availability Zone, and configure the route tables of the private subnets to direct internet-bound traffic to the local NAT Gateway in the same Availability Zone.Answer
- Associate the Route 53 Private Hosted Zone corp.internal with the new application VPC.Answer
- CDeploy a single NAT Gateway in the public subnet of us-east-1a, and update the route tables of both private subnets to route outbound traffic through this single NAT Gateway.
- DEstablish a Transit Gateway attachment between the two VPCs and rely on Transit Gateway routing to automatically resolve DNS queries for corp.internal from the application VPC.
- ECreate a public Route 53 hosted zone for corp.internal and use IAM policies to restrict resolution to the instances within the application VPC.
Answer
Deploy a NAT Gateway in the public subnet of each Availability Zone, and associate the Route 53 Private Hosted Zone corp.internal with the application VPC.
Deploying a NAT Gateway in the public subnet of each Availability Zone provides fault tolerance, preventing a single zone outage from disrupting internet access for other zones. Additionally, associating the Route 53 Private Hosted Zone corp.internal with the application VPC is a required step to allow instances in that VPC to resolve the private domain names.
Step-by-Step Solution
Key Concept
High availability for outbound VPC traffic and DNS resolution across multiple VPCs using NAT Gateways and Route 53 Private Hosted Zone associations.