Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a multi-account AWS environment in the `us-east-1` Region. The architecture includes 1515 spoke VPCs split across two AWS accounts, and a centralized shared services VPC in a third AWS account under the same AWS Organization. The spoke VPCs need to securely access tools in the shared services VPC and communicate with each other. The solutions architect must design a highly scalable network topology that minimizes routing complexity and administrative overhead as new spoke VPCs are provisioned. Which TWO actions should the Solutions Architect take to meet these requirements?

  1. Provision an AWS Transit Gateway in a designated network services account, share the Transit Gateway with the other accounts using AWS Resource Access Manager (RAM), and attach all spoke VPCs and the shared services VPC to the Transit Gateway.Answer
  2. B
    Create a full mesh of VPC peering connections between all 1515 spoke VPCs and the shared services VPC, and enable route propagation in each VPC route table.
  3. Configure the route tables in all spoke VPCs to point traffic destined for the other VPC ranges to the Transit Gateway attachment, and use the default Transit Gateway route table to propagate and associate the VPC attachments.Answer
  4. D
    Deploy an AWS Direct Connect gateway in the network services account, associate all 1515 spoke VPCs and the shared services VPC with the Direct Connect gateway, and enable transitive routing within the Direct Connect gateway settings.
  5. E
    Deploy a single NAT Gateway in the shared services VPC, and configure the route tables of all spoke VPCs to route all internal cross-VPC traffic to the NAT Gateway network interface.

Answer

To meet the requirements with minimal administrative overhead, the Solutions Architect should provision an AWS Transit Gateway in a centralized network services account, share it using AWS Resource Access Manager (RAM) to allow other accounts to attach their VPCs, and update the route tables in all spoke VPCs to point traffic destined for the other VPC ranges to the Transit Gateway attachment.
The correct architecture uses AWS Transit Gateway to establish a hub-and-spoke network topology across accounts. Sharing the Transit Gateway via AWS Resource Access Manager (RAM) allows the spoke accounts to attach their VPCs to the Transit Gateway. By updating the spoke VPC route tables to point to the Transit Gateway attachment for cross-VPC destinations, traffic is transitively routed through the Transit Gateway to other spoke VPCs and the shared services VPC.

Step-by-Step Solution

1
Deploy and share AWS Transit Gateway
An AWS Transit Gateway is provisioned in the central account and shared using AWS Resource Access Manager (RAM) to all accounts within the AWS Organization.
This centralizes transit network management and allows the other accounts to attach their VPCs without manual peer-to-peer setup.
2
Create VPC attachments
Each of the 1515 spoke VPCs and the shared services VPC are attached to the shared Transit Gateway.
This registers the VPC subnets with the Transit Gateway so traffic can flow into and out of the hub.
3
Configure route tables
VPC route tables are configured with routes targeting the Transit Gateway attachment for non-local VPC CIDRs, and the Transit Gateway route table handles propagation and association.
This ensures that traffic destined for other VPCs is routed to the Transit Gateway, which then dynamically routes it to the correct destination attachment.

Key Concept

AWS Transit Gateway simplifies multi-account hub-and-spoke networking by acting as a centralized cloud router, which removes the scaling and administrative limitations of point-to-point VPC peering or Direct Connect Gateway transitive routing.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic