An enterprise is designing a highly available, multi-account hybrid network architecture. The architecture consists of a Shared Services AWS account and spoke VPCs deployed across Availability Zones (AZs) in the us-east-1 Region. The Shared Services account hosts a central Route 53 Private Hosted Zone (PHZ) for internal service discovery. The enterprise requires secure, transitive routing between the spoke VPCs and its on-premises data center, which will be connected via a AWS Direct Connect connection with a backup AWS Site-to-Site VPN. Additionally, all outbound internet traffic from the spoke VPCs must be routed through a centralized egress VPC in the Shared Services account for security inspection. The solution must ensure high availability across all AZs, support internal DNS resolution, and prevent single points of failure. Which of the following designs meets these requirements?
- ADeploy a Direct Connect Gateway (DXGW) and associate it directly with the spoke VPCs using private virtual interfaces (private VIFs) to handle spoke-to-spoke and hybrid traffic routing, bypassing the need for AWS Transit Gateway. In the egress VPC, deploy redundant NAT Gateways across all Availability Zones. Associate the Route 53 Private Hosted Zone in the Shared Services account with all spoke VPCs. Set up a backup Site-to-Site VPN connection to each individual spoke VPC.
- BDeploy an AWS Transit Gateway in the Shared Services account and share it with the spoke VPC accounts using AWS Resource Access Manager (RAM). Attach the spoke VPCs and the centralized egress VPC to the Transit Gateway. In the egress VPC, deploy redundant NAT Gateways across all Availability Zones. Attach the Direct Connect connection via a transit virtual interface (transit VIF) to a Direct Connect Gateway (DXGW) associated with the Transit Gateway, and establish a backup Site-to-Site VPN connection. Create the Route 53 Private Hosted Zone in the Shared Services account and associate it only with the egress VPC, relying on Transit Gateway route propagation to transitively resolve internal DNS queries from the spoke VPCs.
- Deploy an AWS Transit Gateway in the Shared Services account and share it with the spoke VPC accounts using AWS Resource Access Manager (RAM). Attach the spoke VPCs and the centralized egress VPC to the Transit Gateway. In the egress VPC, deploy redundant NAT Gateways across all Availability Zones and route internet-bound traffic through them. Associate the Route 53 Private Hosted Zone in the Shared Services account with all spoke VPCs. Attach the Direct Connect connection via a transit virtual interface (transit VIF) to a Direct Connect Gateway (DXGW) associated with the Transit Gateway, and establish a backup Site-to-Site VPN connection attached directly to the Transit Gateway.Answer
- DDeploy an AWS Transit Gateway in the Shared Services account and share it with the spoke VPC accounts using AWS Resource Access Manager (RAM). Attach the spoke VPCs and the centralized egress VPC to the Transit Gateway. In the egress VPC, deploy a single NAT Gateway in one Availability Zone to minimize running costs. Associate the Route 53 Private Hosted Zone in the Shared Services account with all spoke VPCs. Attach the Direct Connect connection via a transit virtual interface (transit VIF) to a Direct Connect Gateway (DXGW) associated with the Transit Gateway, and establish a backup Site-to-Site VPN connection attached directly to the Transit Gateway.