A maritime shipping company is migrating its legacy Terminal Operating System (TOS) consisting of physical telemetry servers to AWS using AWS Application Migration Service (MGN). The on-premises data center connects to AWS via an AWS Direct Connect connection terminated on an AWS Transit Gateway in a hub VPC. Due to strict security compliance, all replication traffic must be kept entirely private and cannot traverse the public internet. The staging area VPC has no Internet Gateway or NAT Gateway configured. Which TWO configurations are required to ensure the replication agent can communicate with the AWS MGN control plane and successfully replicate block-level data? (Select TWO.)
- Configure the AWS MGN replication template to use private IP routing, and ensure the staging subnet security groups and network access control lists (NACLs) permit inbound TCP port 1500 traffic from the on-premises source servers.Answer
- Create Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN and Amazon EC2 services in the staging VPC, and associate the Route 53 Private Hosted Zones with both the staging VPC and the Transit Gateway hub VPC, ensuring on-premises DNS can resolve these service endpoints to their private IP addresses.Answer
- CConfigure the AWS MGN replication template to route data over public IP addresses, and establish a Transit Gateway public peering connection to route replication traffic through a NAT Gateway in the shared services VPC.
- DInstall the AWS MGN replication agent on the source servers and configure the replication template to route all block-level replication traffic exclusively over HTTPS on TCP port 443 directly to the MGN control plane.
- EDeploy AWS PrivateLink interface endpoints in the staging VPC and establish a Route 53 Private Hosted Zone for the MGN service, but limit its association strictly to the staging VPC to ensure isolation of control plane DNS queries.
Answer
To achieve private migration using AWS Application Migration Service (MGN) without internet access, you must configure the MGN replication template to use private IP routing and allow TCP port 1500 inbound from on-premises to the staging subnet. You must also create VPC interface endpoints for the MGN and EC2 services in the staging VPC and associate the Route 53 Private Hosted Zones with both the staging VPC and the Transit Gateway hub VPC to enable resolution from the on-premises environment.
The correct options are to configure the AWS MGN replication template to route data over private IPs while opening inbound TCP port 1500 in the staging security group, and to configure Interface VPC Endpoints for the MGN and EC2 APIs with Route 53 Private Hosted Zones associated with both the staging and hub VPCs. Together, these steps satisfy both the data-plane replication requirements (private routing over TCP port 1500) and control-plane communication requirements (private API access via PrivateLink with functioning DNS resolution from on-premises).
Step-by-Step Solution
Key Concept
AWS Application Migration Service (MGN) private replication requires configuring the replication template to use private IPs, opening TCP port 1500 for data transfer, and using Route 53 Private Hosted Zones associated with all VPCs handling on-premises traffic to resolve interface VPC endpoints (PrivateLink) privately.