A logistics company is designing a multi-account hybrid AWS network in the `us-east-1` Reg… — AWS Certified Solutions Architect - Professional

A logistics company is designing a multi-account hybrid AWS network in the `us-east-1` Region. The network consists of $12$ spoke VPCs, a centralized egress VPC, and a hybrid connection to an on-premises data center via AWS Direct Connect. The architecture must satisfy the following constraints:
- Spoke VPCs must not be able to communicate with each other.
- All spoke VPCs must route their outbound internet traffic ( $0.0.0.0/0$ ) through the egress VPC, which hosts a redundant cluster of NAT Gateways.
- Spoke VPC workloads must resolve on-premises DNS records hosted on local Active Directory servers.
- Administrative and routing table configuration overhead must be minimized.

Which combination of configuration steps should a Solutions Architect recommend to meet these requirements?

Create two AWS Transit Gateway route tables: a Spoke Route Table and an Egress/Hybrid Route Table. Associate the spoke VPC attachments with the Spoke Route Table, adding static routes for $0.0.0.0/0$ pointing to the egress VPC attachment and the on-premises CIDR pointing to the Direct Connect gateway attachment. Disable route propagation from the spoke VPCs in this table. Associate the egress VPC and Direct Connect gateway attachments with the Egress/Hybrid Route Table, and propagate the spoke VPC routes. Deploy a Route 53 Resolver outbound endpoint in the egress VPC and associate a forwarding rule for the on-premises domain with all spoke VPCs.Answer
B
Associate the Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) of all $12$ spoke VPCs to bypass Transit Gateway for hybrid traffic. For internet traffic, associate all spoke VPCs and the egress VPC with a single Transit Gateway route table, propagating all routes to allow spoke VPCs to route $0.0.0.0/0$ to the egress VPC. Deploy a Route 53 Resolver outbound endpoint in the egress VPC and associate a forwarding rule for the on-premises domain with all spoke VPCs.
C
Create two AWS Transit Gateway route tables: a Spoke Route Table and an Egress/Hybrid Route Table. Associate the spoke VPC attachments with the Spoke Route Table, and add static routes for $0.0.0.0/0$ pointing to the egress VPC attachment and the on-premises CIDR pointing to the Direct Connect gateway attachment. Create a Route 53 Private Hosted Zone (PHZ) for the on-premises domain in the egress VPC's account, associate the PHZ only with the egress VPC, and rely on Transit Gateway to route DNS resolution traffic transitively from the spoke VPCs to the egress VPC.
D
Create two AWS Transit Gateway route tables: a Spoke Route Table and an Egress/Hybrid Route Table. Associate the spoke VPC attachments with the Spoke Route Table, and add static routes for $0.0.0.0/0$ pointing to the egress VPC attachment and the on-premises CIDR pointing to the Direct Connect gateway attachment. In the egress VPC, deploy a single NAT Gateway in one Availability Zone to act as a centralized egress point for all spoke VPCs. Deploy a Route 53 Resolver outbound endpoint in the egress VPC and associate a forwarding rule for the on-premises domain with all spoke VPCs.

Answer

Create two Transit Gateway route tables (Spoke and Egress/Hybrid) to achieve network isolation. Associate spoke VPCs with the Spoke Route Table with static routes to egress and hybrid attachments without propagation. Associate egress and hybrid attachments with the Egress/Hybrid Route Table and propagate spoke routes. Deploy a Route 53 Resolver outbound endpoint in the egress VPC and associate a forwarding rule for the on-premises domain with all spoke VPCs.

The correct architecture uses AWS Transit Gateway with route table isolation to prevent spoke-to-spoke communication. By placing spoke VPC attachments in a route table that does not propagate spoke routes, spokes cannot reach each other. Outbound internet traffic and on-premises traffic are directed via static routes to the egress VPC and Direct Connect gateway respectively. For DNS, a Route 53 Resolver outbound endpoint with a forwarding rule associated with all spoke VPCs enables DNS resolution for the on-premises domain across all accounts.

Step-by-Step Solution

Set up Transit Gateway and route tables to isolate spoke traffic.

Two route tables are created: a Spoke Route Table and an Egress/Hybrid Route Table.

Separating route domains prevents spoke VPCs from learning routes to each other, ensuring isolation.

Configure the Spoke Route Table with static routes.

Spoke attachments are associated with the Spoke Route Table. Static routes are added for

0.0.0.0/0

(pointing to the egress VPC) and the on-premises CIDR (pointing to the Direct Connect gateway). Route propagation from the spokes is disabled.

This directs outbound and on-premises traffic to the appropriate attachments while blocking spoke-to-spoke routing.

Configure the Egress/Hybrid Route Table with route propagation.

The egress VPC and Direct Connect gateway attachments are associated with the Egress/Hybrid Route Table. Spoke VPC routes are propagated here.

This allows return traffic from the internet egress point and the on-premises data center to find paths back to the spokes.

Configure hybrid DNS resolution.

A Route 53 Resolver outbound endpoint is deployed in the egress VPC, and a forwarding rule for the on-premises domain is created and associated with all 12 spoke VPCs.

This allows workloads in all spoke VPCs to forward DNS queries for the on-premises domain to the local Active Directory servers.

Key Concept

Multi-account network isolation and hybrid DNS routing using AWS Transit Gateway and Route 53 Resolver.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic