Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A manufacturing company has 33 separate AWS accounts within an AWS Organization. Each account has a VPC in the `us-east-1` region containing production workloads. The company wants to establish hybrid connectivity between all 33 VPCs and their on-premises data center. To achieve this, the company has provisioned a single 1 Gbps1\text{ Gbps} AWS Direct Connect connection. The solution must support direct VPC-to-VPC communication and provide a backup pathway over the internet using a Site-to-Site VPN in case the Direct Connect connection fails. The configuration must minimize administrative overhead and routing complexity. Which design should a solutions architect recommend to satisfy these requirements?

  1. Deploy an AWS Transit Gateway in the organization's network account. Share the Transit Gateway with the other accounts using AWS Resource Access Manager (RAM). Attach the three VPCs to the Transit Gateway. Create a Direct Connect Gateway, associate it with the Transit Gateway using a transit virtual interface (VIF) on the Direct Connect connection, and establish an IPsec Site-to-Site VPN from the on-premises data center to the Transit Gateway. Configure BGP on-premises to prefer the Direct Connect path.Answer
  2. B
    Create a Direct Connect Gateway and associate it directly with the Virtual Private Gateways (VGWs) attached to each of the three VPCs using private virtual interfaces (VIFs). Establish separate IPsec Site-to-Site VPN connections from the on-premises data center to each VPC's VGW. Configure BGP on-premises to prefer the Direct Connect paths.
  3. C
    Deploy an AWS Transit Gateway in the organization's network account. Create a Direct Connect Gateway and associate it with the Transit Gateway using a private virtual interface (VIF) on the Direct Connect connection. Share the Transit Gateway using AWS Resource Access Manager (RAM) by disabling organizational sharing and manually inviting the other accounts. Establish a Site-to-Site VPN directly to each VPC's VGW.
  4. D
    Establish a full mesh of VPC peering connections among the three VPCs to enable direct VPC-to-VPC communication. Connect the on-premises data center to each VPC by creating three separate private virtual interfaces (VIFs) on the Direct Connect connection and associating them with individual Virtual Private Gateways (VGWs) on each VPC. Deploy a single Site-to-Site VPN to one VPC and configure routing tables manually.

Answer

Deploy an AWS Transit Gateway in the organization's network account. Share the Transit Gateway with the other accounts using AWS Resource Access Manager (RAM). Attach the three VPCs to the Transit Gateway. Create a Direct Connect Gateway, associate it with the Transit Gateway using a transit virtual interface (VIF) on the Direct Connect connection, and establish an IPsec Site-to-Site VPN from the on-premises data center to the Transit Gateway. Configure BGP on-premises to prefer the Direct Connect path.
The correct architecture uses a central AWS Transit Gateway shared across accounts using AWS Resource Access Manager (RAM). The VPCs are attached to this Transit Gateway, enabling direct VPC-to-VPC routing. The Direct Connect Gateway is associated with the Transit Gateway via a transit virtual interface (VIF) to enable primary hybrid traffic flow. Additionally, an IPsec Site-to-Site VPN is established directly to the Transit Gateway, and BGP routing on-premises is configured to prioritize the Direct Connect path, ensuring automatic failover. This design minimizes administrative overhead and routing complexity.

Step-by-Step Solution

1
Consolidate spoke VPC connectivity using AWS Transit Gateway shared via AWS Resource Access Manager (RAM) to allow direct VPC-to-VPC traffic in a hub-and-spoke model.
This eliminates the need for complex mesh VPC peering or hair-pinning traffic through the on-premises data center.
To satisfy the requirement of direct VPC-to-VPC communication while minimizing administrative overhead.
2
Create an AWS Direct Connect Gateway and associate it with the Transit Gateway using a transit virtual interface (VIF).
Hybrid connectivity is established from the on-premises network to the Transit Gateway, enabling access to all attached VPCs over the Direct Connect connection.
Transit Gateway requires a transit VIF (not a private VIF) for Direct Connect Gateway association.
3
Establish an IPsec Site-to-Site VPN connection from the on-premises data center to the Transit Gateway as a backup path.
Both the Direct Connect and VPN paths terminate on the same Transit Gateway, providing a resilient path configuration.
To ensure automatic failover to the backup path over the internet if the Direct Connect link fails.
4
Configure BGP routing on the on-premises router to prioritize the Direct Connect path over the VPN connection.
Traffic automatically uses the higher-bandwidth Direct Connect connection as the primary path and falls back to the VPN in the event of an outage.
Dynamic routing via BGP simplifies failover management and avoids complex static route maintenance.

Key Concept

AWS Transit Gateway simplifies multi-account and hybrid network topologies by acting as a cloud router, enabling transitive routing between VPCs and supporting transit VIFs for Direct Connect along with Site-to-Site VPN failover.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic