An enterprise is designing a multi-account AWS environment with spoke VPCs in the `us-east-1` Region across multiple AWS accounts under an AWS Organization. The network requirements are:
- Low-latency, bi-directional network communication between all spoke VPCs.
- Hybrid connectivity to an on-premises datacenter via an AWS Direct Connect connection with a speed of .
- Centralized, highly available internet egress filtering for all spoke VPCs to download software patches.
- DNS resolution of a shared services domain (`corp.internal`) hosted in a central Network services account.
Which architecture should a solutions architect design to meet these requirements while ensuring high availability, scalable routing, and proper DNS resolution?
- AAttach all spoke VPCs to a central AWS Direct Connect Gateway (DXGW) using Virtual Private Gateways (VGWs) to enable direct hybrid connectivity and VPC-to-VPC routing. Deploy NAT Gateways in multiple Availability Zones within each spoke VPC for egress. Create a Route 53 Private Hosted Zone (PHZ) for `corp.internal` in the Network account, and associate it with all spoke VPCs using cross-account VPC association authorizations.
- BCreate an AWS Transit Gateway (TGW) in the Network services account, share it with the spoke accounts using AWS Resource Access Manager (RAM), and attach all spoke VPCs to the TGW. Associate the TGW with an AWS Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF). Deploy a centralized egress VPC with a single NAT Gateway in one Availability Zone to minimize cost. Create a Route 53 Private Hosted Zone (PHZ) for `corp.internal` in the Network account, and associate the PHZ with the spoke VPCs in all accounts using cross-account VPC association authorizations.
- Create an AWS Transit Gateway (TGW) in the Network services account, share it with the spoke accounts using AWS Resource Access Manager (RAM), and attach all spoke VPCs to the TGW. Associate the TGW with an AWS Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF). Deploy a centralized egress VPC with NAT Gateways in multiple Availability Zones attached to the TGW. Create a Route 53 Private Hosted Zone (PHZ) for `corp.internal` in the Network account, and associate the PHZ with the spoke VPCs in all accounts using cross-account VPC association authorizations.Answer
- DCreate an AWS Transit Gateway (TGW) in the Network services account, share it with the spoke accounts using AWS Resource Access Manager (RAM), and attach all spoke VPCs to the TGW. Associate the TGW with an AWS Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF). Deploy a centralized egress VPC with NAT Gateways in multiple Availability Zones attached to the TGW. Create a Route 53 Private Hosted Zone (PHZ) for `corp.internal` in the Network account, relying on Transit Gateway route propagation to automatically resolve DNS queries across accounts.
Answer
The correct architecture uses AWS Transit Gateway to route traffic between spoke VPCs and hybrid locations, employs a centralized egress VPC with NAT Gateways in multiple Availability Zones for highly available internet egress, and associates the Route 53 Private Hosted Zone in the central account with all spoke VPCs using cross-account VPC authorizations.
The correct architecture uses AWS Transit Gateway to achieve transitive inter-VPC and hybrid routing, while integrating a centralized egress VPC with redundant NAT Gateways across multiple Availability Zones to prevent a single point of failure. It also ensures that the central Private Hosted Zone is explicitly associated with all spoke VPCs using cross-account VPC association authorizations.
Step-by-Step Solution
Key Concept
Multi-account and hybrid network routing with Transit Gateway, Direct Connect Gateway, redundant centralized egress, and cross-account Private Hosted Zone association.
Estimated Time:3m 0s