An enterprise wants to establish hybrid connectivity between three spoke VPCs in different AWS accounts and their on-premises data center. The design must satisfy the following requirements:
1. The VPCs must be able to communicate with each other (VPC-to-VPC routing).
2. The VPCs must connect to the on-premises data center using a single AWS Direct Connect connection.
3. Private DNS resolution for a shared internal domain must be accessible across all VPCs.
Which architecture meets these requirements with the least operational complexity?
- Attach the three spoke VPCs to an AWS Transit Gateway, connect the Transit Gateway to the on-premises data center using an AWS Direct Connect Gateway with a transit virtual interface, and associate the Route 53 Private Hosted Zone with all three spoke VPCs.Answer
- BConnect the three spoke VPCs directly to an AWS Direct Connect Gateway using Virtual Private Gateways and private virtual interfaces, and configure a shared Route 53 Private Hosted Zone associated with the Direct Connect Gateway.
- CAttach the three spoke VPCs to an AWS Transit Gateway, connect the Transit Gateway to the on-premises data center using an AWS Direct Connect Gateway with a transit virtual interface, and create the Route 53 Private Hosted Zone only in the shared services account without associating it with the spoke VPCs.
- DAttach the three spoke VPCs to an AWS Transit Gateway, connect the Transit Gateway to the on-premises data center using a Direct Connect Gateway, and route all outbound internet traffic from all Availability Zones in the spoke VPCs through a single NAT Gateway deployed in one subnet of a centralized VPC.
Answer
Attach the three spoke VPCs to an AWS Transit Gateway, connect the Transit Gateway to the on-premises data center using an AWS Direct Connect Gateway with a transit virtual interface, and associate the Route 53 Private Hosted Zone with all three spoke VPCs.
The correct answer combines AWS Transit Gateway for transitive VPC-to-VPC routing, an AWS Direct Connect Gateway with a transit virtual interface for hybrid connectivity, and associates the Route 53 Private Hosted Zone with all three spoke VPCs to allow DNS resolution.
Step-by-Step Solution
Key Concept
AWS Transit Gateway is required for multi-VPC transitive routing and hybrid connectivity via Direct Connect Gateway, while Route 53 Private Hosted Zones must be explicitly associated with all consuming VPCs.
Estimated Time:2m 0s