A logistics company is migrating legacy route optimization virtual machines from an on-premises VMware vSphere cluster to AWS using AWS Application Migration Service (MGN). The replication traffic must flow privately over an existing AWS Direct Connect connection with a private virtual interface (VIF) terminated at an AWS Transit Gateway. The Transit Gateway connects to a Staging Area VPC. A dedicated Shared Services VPC hosts central Route 53 Private Hosted Zones (PHZs) and Route 53 Resolver endpoints. The company's security policy prohibits any public internet access for the source VMs and the staging environment.
During the initial replication phase, the migration team observes that the MGN Replication Agents installed on the source VMs fail to establish data replication with the Replication Servers in the Staging Area VPC, although control plane connectivity to the MGN endpoints is established.
Which combination of configuration steps will resolve the replication failure and ensure the migration succeeds over the private path in accordance with the security policy?
- ABypass the Transit Gateway by establishing a new public virtual interface on the Direct Connect connection to route replication traffic directly to the MGN public endpoints, configure the Staging Area VPC route tables to point to the Direct Connect Gateway as the next hop, and allow TCP port on the Staging Area VPC network access control lists.
- BConfigure the Staging Area VPC security groups to allow inbound traffic on TCP port , but restrict the Route 53 Private Hosted Zone associations exclusively to the Shared Services VPC to maintain centralized DNS management, relying on conditional forwarders on the on-premises DNS servers pointing to Route 53 Resolver inbound endpoints.
- Configure the Staging Area VPC security groups to allow inbound traffic on TCP port from the on-premises subnet range, associate the Route 53 Private Hosted Zones for the MGN and EC2 interface endpoints with the Staging Area VPC, and verify that the Transit Gateway route tables contain appropriate routes for transitive traffic between the on-premises network and the Staging Area VPC.Answer
- DConfigure the Staging Area VPC security groups to allow inbound traffic on TCP port for data replication, deploy a single NAT Gateway in a single Availability Zone of the Staging Area VPC to route outbound data replication traffic, and associate the Route 53 Private Hosted Zone with the target workload VPC.