A logistics company is designing a hybrid network connectivity solution for its AWS environment. The environment consists of spoke VPCs across two AWS accounts in the `us-east-1` region. The company has a AWS Direct Connect connection at a co-location facility and needs to establish connectivity between the spoke VPCs and their on-premises data center. The solution must provide a backup path using an IPsec VPN over the internet with automated failover, and it must minimize administrative overhead for routing. Which TWO configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Create an AWS Transit Gateway, attach the spoke VPCs to the Transit Gateway, and associate the Transit Gateway with a Direct Connect Gateway that connects to on-premises via a Transit Virtual Interface.Answer
- Configure an IPsec Site-to-Site VPN connection directly to the Transit Gateway, establishing a backup path that propagates routes via BGP.Answer
- CAssociate all spoke VPCs directly with the Direct Connect Gateway using Virtual Private Gateways to establish the primary path, and configure a Site-to-Site VPN to each VPC for backup.
- DDeploy a single NAT Gateway in a central services VPC to route all hybrid traffic, and configure routing tables in all spoke VPCs to point to this NAT Gateway for backup paths.
- ECreate a private hosted zone in one account and rely on the Direct Connect Gateway to automatically bridge DNS queries from the on-premises data center to the spoke VPCs.
Answer
Establish the hybrid connectivity by deploying an AWS Transit Gateway to attach all spoke VPCs and associate the Transit Gateway with a Direct Connect Gateway using a Transit Virtual Interface for the primary path. For the backup path, configure an IPsec Site-to-Site VPN terminating directly on the Transit Gateway, enabling BGP to manage failover preference.
The correct solution involves deploying an AWS Transit Gateway to aggregate the 25 spoke VPCs and linking it to the on-premises network via a Direct Connect Gateway (using a Transit VIF) and a Site-to-Site VPN attachment. Transit Gateway supports up to 5000 VPC attachments and handles dynamic routing failover. For identical prefix advertisements, Transit Gateway naturally prefers the Direct Connect Gateway attachment path over the VPN attachment path, achieving automated failover with minimal routing overhead.
Step-by-Step Solution
Key Concept
AWS Transit Gateway serves as a scalable hub for multi-account networking, routing traffic over both Direct Connect (via Direct Connect Gateway and Transit VIF) and Site-to-Site VPN, while natively prioritizing Direct Connect paths over VPN paths when identical prefixes are advertised.