An online education platform is deploying its new containerized application across three VPCs (vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database) in the us-east-2 region. The application requires outbound internet access for package updates, private DNS resolution using a custom domain (internal.edu.aws), and communication between the three VPCs. The solution must be highly available across two Availability Zones, minimize management overhead, and ensure that VPC-to-VPC traffic does not traverse the public internet. Which architecture meets these requirements?
- ADeploy an AWS Transit Gateway tgw-edu-us-east-2 to interconnect vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database. Create a centralized egress VPC vpc-edu-egress containing a single NAT Gateway in one Availability Zone. Route outbound traffic from the application VPCs through tgw-edu-us-east-2 to vpc-edu-egress. Create a Route 53 Private Hosted Zone for internal.edu.aws and associate it with all three application VPCs.
- Deploy an AWS Transit Gateway tgw-edu-us-east-2 to interconnect vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database. Create a centralized egress VPC vpc-edu-egress containing a NAT Gateway in each of the two Availability Zones. Route outbound traffic from the application VPCs through tgw-edu-us-east-2 to vpc-edu-egress. Create a Route 53 Private Hosted Zone for internal.edu.aws and associate it with all three application VPCs.Answer
- CDeploy an AWS Transit Gateway tgw-edu-us-east-2 to interconnect vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database. Create a centralized egress VPC vpc-edu-egress containing a NAT Gateway in each of the two Availability Zones. Route outbound traffic from the application VPCs through tgw-edu-us-east-2 to vpc-edu-egress. Create a Route 53 Private Hosted Zone for internal.edu.aws in the vpc-edu-frontend account and configure Route 53 Resolver endpoints to forward queries from the other two VPCs without associating the Private Hosted Zone with them.
- DInterconnect vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database using VPC Peering in a full-mesh configuration. Set up an AWS Direct Connect Gateway and attach it to the three VPCs, configuring the Direct Connect Gateway to route transitive traffic between the VPCs and to a single on-premises NAT appliance for egress traffic. Create a Route 53 Private Hosted Zone for internal.edu.aws and associate it with all three application VPCs.
Answer
The correct architecture uses AWS Transit Gateway to interconnect the application VPCs, deploys a centralized egress VPC with redundant NAT Gateways across two Availability Zones, and associates the Route 53 Private Hosted Zone with all three application VPCs.
The correct architecture uses AWS Transit Gateway to securely route traffic between all three application VPCs. High availability is achieved by placing a NAT Gateway in both Availability Zones inside a centralized egress VPC, routing all outbound internet traffic from the applications through the Transit Gateway to this egress VPC. Finally, associating the Route 53 Private Hosted Zone with all three application VPCs ensures they can resolve the custom domain names directly with minimal overhead.
Step-by-Step Solution
Key Concept
Designing multi-VPC networks using AWS Transit Gateway, implementing high availability NAT gateway egress architectures, and associating Route 53 Private Hosted Zones across multiple VPCs in the same region.