A financial services company is migrating its core ledger application servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The replication traffic must be routed over a dedicated AWS Direct Connect connection and must not traverse the public internet. The staging area is configured within a dedicated VPC. Which of the following configuration steps must be performed to establish secure, private data replication from the on-premises servers to the staging area? (Select TWO.)
- Configure the replication template to use a private IP address for replication, and ensure the staging area security groups allow inbound traffic on TCP port 1500 from the on-premises subnet range.Answer
- Establish interface VPC endpoints (AWS PrivateLink) for the MGN service in the staging VPC, and ensure that the on-premises DNS resolves the MGN API endpoints to these private IP addresses.Answer
- CConfigure the staging area security group to only allow inbound traffic on TCP port 443, as the MGN replication agent compresses and tunnels all volume blocks over HTTPS to the staging area.
- DConfigure a Direct Connect Gateway to establish a transitive path between the on-premises data center and the staging VPC, routing all replication traffic directly through the Direct Connect Gateway without configuring a virtual private gateway or Transit Gateway.
- EDeploy a single NAT Gateway in the public subnet of the staging VPC's primary Availability Zone to route all replication control plane traffic, accepting that any failure of that Availability Zone will temporarily halt replication until manual failover occurs.
Answer
The correct configurations are allowing inbound traffic on TCP port 1500 from the on-premises range to the staging area security groups with private IP replication enabled, and creating interface VPC endpoints for AWS Application Migration Service in the staging VPC while resolving the API endpoints via on-premises DNS.
To perform private replication using AWS Application Migration Service (MGN) without internet traversal, the replication servers must communicate over the private connection. The replication data is sent over TCP port 1500, requiring security groups to allow inbound port 1500 from on-premises sources. Additionally, the replication agent must communicate with the MGN control plane API over HTTPS (TCP port 443). Since the traffic must not traverse the internet, interface VPC endpoints (AWS PrivateLink) for MGN must be established in the staging VPC, and the on-premises DNS must be configured to resolve the MGN service endpoints to these private endpoint IPs.
Step-by-Step Solution
Key Concept
Private infrastructure replication using AWS Application Migration Service (MGN) over Direct Connect requiring TCP port 1500 for data replication and interface VPC endpoints for control plane API.