An enterprise is designing a multi-Region, multi-account hybrid network architecture for its AWS Organizations environment. The workload consists of production spoke VPCs in the `us-east-1` Region and development spoke VPCs in the `us-west-2` Region. The architecture must satisfy the following requirements:
* Outbound internet traffic from all spoke VPCs in both Regions must be routed through centralized NAT Gateways to minimize costs. A failure of a NAT Gateway in one Availability Zone (AZ) must not impact outbound traffic from other AZs.
* Hybrid connectivity to the on-premises network () must use a dedicated AWS Direct Connect (DX) connection in `us-east-1` as the primary path. A backup AWS Site-to-Site VPN connection in `us-east-1` must be used only if the DX connection fails.
* All spoke VPCs in both Regions must resolve private DNS queries for resources in a Route 53 Private Hosted Zone (PHZ) named `corp.internal` hosted in a centralized Shared Services account.
Which of the following architectures meets these requirements while ensuring high availability, minimizing costs, and preventing asymmetric routing?
- ADeploy a Transit Gateway (TGW) in each Region (`tgw-east` and `tgw-west`) and establish a peering attachment between them. Deploy a centralized Egress VPC in each Region, each containing a NAT Gateway in each AZ. Configure the spoke VPC route tables to route internet-bound traffic to their local TGW and then to the local Egress VPC. Associate `tgw-east` with the DXGW. Establish the backup Site-to-Site VPN on `tgw-east`. Advertise the prefix over both BGP sessions. On the customer gateway, prepend the local autonomous system (AS) path multiple times on the Direct Connect BGP session to ensure it is preferred over the VPN. Associate the `corp.internal` PHZ with the Shared Services VPC, and rely on TGW Peering to transitively resolve DNS queries for all spoke VPCs without individual VPC associations.
- Deploy a Transit Gateway (TGW) in each Region (`tgw-east` and `tgw-west`) and establish a peering attachment between them. Deploy a centralized Egress VPC in each Region, each containing a NAT Gateway in each AZ. Configure the spoke VPC route tables to route internet-bound traffic (`0.0.0.0/0`) to their local TGW, which routes it to the local Egress VPC. In the Egress VPC, route traffic from each subnet to the NAT Gateway in the same AZ. Associate `tgw-east` with a Direct Connect Gateway (DXGW) connected to the DX connection. Establish the backup Site-to-Site VPN terminating on `tgw-east`. Advertise the prefix over both BGP sessions, and configure the customer gateway to assign a higher Local Preference to routes received via the DX connection. Authorize and associate the `corp.internal` Private Hosted Zone in the Shared Services account with all spoke VPCs in both Regions.Answer
- CDeploy a Transit Gateway (TGW) in each Region and peer them. Deploy a single centralized Egress VPC in `us-east-1` with one NAT Gateway. Route all internet-bound traffic from both Regions to `tgw-east` and then to the Egress VPC. Configure the backup Site-to-Site VPN to advertise a more specific prefix () than the Direct Connect connection () to ensure the VPN is preferred for backup routing. Create Route 53 Resolver inbound and outbound endpoints in each spoke VPC to forward queries for `corp.internal` to the Shared Services account.
- DConnect all spoke VPCs in both Regions directly to the DXGW to enable transitive VPC-to-VPC routing. Deploy a centralized Egress VPC in `us-east-1` with a NAT Gateway in each AZ, routing all internet traffic from both Regions to this VPC via the DXGW. Establish the backup VPN on the DXGW, and advertise the prefix over both BGP sessions. In the Shared Services account, share the `corp.internal` zone via AWS Resource Access Manager (RAM) to all accounts, and associate it locally.