Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a multi-region database solution. The primary database is located in `vpc-primary` in `us-east-1` across two Availability Zones, and its read replica is in `vpc-replica` in `us-west-2` across two Availability Zones. A corporate datacenter requires private access to both VPCs over an existing 10 Gbps AWS Direct Connect connection terminated at a Direct Connect Gateway (DXGW). The replication traffic between the databases must be highly performant and use the AWS private backbone. Additionally, database instances in both VPCs require highly available outbound internet access for security patching. A Route 53 Private Hosted Zone (PHZ) named `databases.internal` must be resolvable from both VPCs and from the corporate datacenter. Which network architecture meets these requirements with the lowest latency and highest availability?

  1. A
    Deploy AWS Transit Gateway in both regions, peer them for database replication, and associate the DXGW only with the Transit Gateway in us-east-1, routing the us-west-2 datacenter traffic transitively over the Transit Gateway peering connection. Deploy a NAT Gateway in one Availability Zone in each VPC. Associate the Private Hosted Zone with vpc-primary and configure Route 53 Resolver Inbound Endpoints in both VPCs.
  2. B
    Associate both vpc-primary and vpc-replica with the DXGW using Virtual Private Gateways to route both database replication and datacenter traffic. Deploy a NAT Gateway in each Availability Zone in both VPCs. Associate the Private Hosted Zone with vpc-primary and set up Route 53 Resolver Inbound Endpoints in both VPCs to forward queries to the on-premises DNS servers.
  3. Deploy AWS Transit Gateway in both regions, peer them for database replication, and associate the DXGW with both Transit Gateways to provide datacenter access. In each VPC, deploy a NAT Gateway in each Availability Zone for patching. Associate the Private Hosted Zone with both VPCs, and deploy Route 53 Resolver Inbound Endpoints in the VPCs to handle DNS queries from the corporate datacenter.Answer
  4. D
    Deploy AWS Transit Gateway only in us-east-1 and peer it to vpc-replica via an inter-region VPC peering connection. Associate the DXGW with the Transit Gateway to provide datacenter access to both regions. Deploy a single NAT Gateway in vpc-primary to handle internet egress for both VPCs. Associate the Private Hosted Zone with vpc-primary and create Route 53 Resolver Outbound Endpoints to resolve DNS queries from the datacenter.

Answer

The architecture deploying Transit Gateways in both regions, peered together, with the Direct Connect Gateway associated to both Transit Gateways, along with multi-AZ NAT Gateways in each VPC and the Private Hosted Zone associated with both VPCs.
Peering the Transit Gateways enables direct, low-latency, and high-performance inter-region replication over the AWS private backbone. Associating the Direct Connect Gateway with both Transit Gateways allows the on-premises datacenter to access both VPCs without routing traffic transitively through the peering connection, which is not supported. Deploying NAT Gateways in every Availability Zone ensures high availability for outbound patching. Associating the Route 53 Private Hosted Zone with both VPCs and creating Inbound Endpoints allows seamless DNS resolution from both VPCs and the on-premises network.

Step-by-Step Solution

1
Configure hybrid connectivity routing
Associate the Direct Connect Gateway with Transit Gateways in both us-east-1 and us-west-2 to allow direct communication from the datacenter to each VPC without violating transitive routing constraints.
AWS Transit Gateway peering does not support transitive routing from attached Direct Connect Gateways. Therefore, the DXGW must be associated with the Transit Gateways in both regions to enable on-premises access to both VPCs.
2
Configure inter-region database replication paths
Establish a Transit Gateway peering connection between the primary and replica Transit Gateways, and update the route tables to route database replication traffic over this peering connection.
This routes the database traffic over the AWS global network infrastructure, providing the lowest latency and highest throughput for replication.
3
Design highly available internet egress
Deploy a NAT Gateway in each Availability Zone where the databases are deployed in both vpc-primary and vpc-replica, updating the private route tables to route 0.0.0.0/0 to the local NAT Gateway in the same zone.
This configuration avoids cross-AZ dependencies and prevents a single NAT Gateway failure from disabling outbound patching capability for the database instances.
4
Implement DNS resolution architecture
Associate the single Route 53 Private Hosted Zone with both vpc-primary and vpc-replica. Deploy Route 53 Resolver Inbound Endpoints in the VPCs and configure the corporate DNS server to forward queries for databases.internal to these endpoint IP addresses.
Associating the Private Hosted Zone with both VPCs ensures that database instances in both regions can resolve the private endpoints. Route 53 Inbound Endpoints allow the corporate datacenter to resolve the hosted zone records via the Direct Connect connection.

Key Concept

Designing multi-region hybrid networks using AWS Transit Gateway peering, Direct Connect Gateway associations, Route 53 Private Hosted Zone multi-VPC sharing, and high-availability NAT architectures.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic