An enterprise is designing a highly resilient hybrid network architecture to connect its AWS multi-Region environment with an on-premises datacenter. The AWS deployment spans two Regions: `us-east-1` (containing `vpc-app-use1` for workloads and `vpc-sec-use1` for egress security control) and `us-west-2` (containing `vpc-app-usw2` for workloads and `vpc-sec-usw2` for egress security control). A single AWS Direct Connect connection terminates at a Direct Connect Gateway (`dxgw-global`). The solution must satisfy the following requirements:
1. VPCs within each Region must route inter-VPC traffic via a regional AWS Transit Gateway (`tgw-use1` and `tgw-usw2`).
2. Workloads in both Regions must access the on-premises network with minimal latency and high availability.
3. Outbound internet traffic from application VPCs must route through the security VPC in their respective Region. This traffic must remain highly available even during an Availability Zone (AZ) outage, without routing across Regions.
4. Active Directory DNS queries for `corp.local` must resolve to on-premises DNS servers, while queries for the Route 53 Private Hosted Zone (PHZ) `aws.corp` (hosted in a centralized AWS account) must resolve across all VPCs.
Which of the following connectivity and DNS configurations meets these requirements while minimizing latency and single points of failure?
- AAssociate `dxgw-global` only with `tgw-use1` in the primary Region. Establish a Transit Gateway peering connection between `tgw-use1` and `tgw-usw2` to route all on-premises traffic from `us-west-2` transitively through the peering link. Deploy redundant NAT Gateways across multiple Availability Zones in `vpc-sec-use1` and `vpc-sec-usw2`. Point the default route () in the application VPCs to their local Transit Gateway, routing to the local security VPC. Associate the `aws.corp` Private Hosted Zone with all VPCs in both Regions.
- Associate `dxgw-global` with both `tgw-use1` and `tgw-usw2` using transit virtual interfaces. Establish a Transit Gateway peering connection between `tgw-use1` and `tgw-usw2` for inter-Region VPC-to-VPC traffic. Deploy redundant NAT Gateways across multiple Availability Zones in both `vpc-sec-use1` and `vpc-sec-usw2`. In the route tables of the application VPCs, point the default route () to the local Transit Gateway, which routes to the local security VPC. Create Route 53 Resolver outbound endpoints in the security VPCs of both Regions and configure forwarding rules for `corp.local` pointing to the on-premises DNS servers. Authorize cross-account Private Hosted Zone association and associate the `aws.corp` Private Hosted Zone with all application and security VPCs in both Regions.Answer
- CAssociate `dxgw-global` with both `tgw-use1` and `tgw-usw2` using transit virtual interfaces. Establish a Transit Gateway peering connection between `tgw-use1` and `tgw-usw2`. Deploy a single NAT Gateway in a single Availability Zone in both `vpc-sec-use1` and `vpc-sec-usw2` to minimize NAT gateway costs. In the route tables of the application VPCs, point the default route () to the local Transit Gateway, which routes to the local security VPC. Create Route 53 Resolver outbound endpoints in the security VPCs of both Regions and configure forwarding rules for `corp.local` pointing to the on-premises DNS servers. Authorize cross-account Private Hosted Zone association and associate the `aws.corp` Private Hosted Zone with all application and security VPCs in both Regions.
- DAssociate `dxgw-global` with both `tgw-use1` and `tgw-usw2` using transit virtual interfaces. Establish a Transit Gateway peering connection between `tgw-use1` and `tgw-usw2`. Deploy redundant NAT Gateways across multiple Availability Zones in both `vpc-sec-use1` and `vpc-sec-usw2`. In the route tables of the application VPCs, point the default route () to the local Transit Gateway, which routes to the local security VPC. Create Route 53 Resolver outbound endpoints in the security VPCs of both Regions and configure forwarding rules for `corp.local` pointing to the on-premises DNS servers. Associate the `aws.corp` Private Hosted Zone only with the centralized network account's VPC, and configure a Route 53 Resolver conditional forwarding rule in all application VPCs to forward queries for `aws.corp` to Route 53 Resolver inbound endpoints deployed in the network account's VPC.