A financial technology corporation is designing a hybrid network architecture to connect its on-premises core banking systems to a multi-account AWS environment. The AWS footprint consists of spoke VPCs in the `us-east-1` Region, containing applications that require high-throughput, low-latency access to the on-premises database.
The network architecture requirements are:
- A AWS Direct Connect (DX) connection via a Direct Connect Gateway (DXGW) serves as the primary path.
- A Site-to-Site VPN connection over the internet serves as the backup path.
- Under normal operating conditions, all traffic between the spoke VPCs and the on-premises data center must utilize the DX connection.
- If the DX connection fails, traffic must fail over automatically and bidirectionally to the Site-to-Site VPN.
- On-premises clients must resolve the domain names of AWS resources hosted in a Route 53 Private Hosted Zone (PHZ) associated with a centralized Shared Services VPC.
- The design must minimize administrative overhead and ensure high availability of outbound internet traffic from the spokes.
A Solutions Architect deploys an AWS Transit Gateway (TGW) in `us-east-1` and attaches all spoke VPCs to it. Which of the following configuration strategies should the Solutions Architect implement to meet these requirements?
- AAttach the DXGW and VPN to the TGW. Configure BGP on the customer gateway to advertise a more specific subnet prefix over the VPN connection and a summary prefix over the DX connection. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC, and associate the PHZ with all spoke VPCs and the Shared Services VPC. Deploy a single NAT Gateway in one Availability Zone of the Shared Services VPC and direct all spoke outbound internet traffic to it.
- BConnect the spoke VPCs directly to the DXGW using private virtual interfaces (VIFs). Attach the Site-to-Site VPN to the TGW, and configure the spoke VPCs' route tables with a default route pointing to the TGW as the backup path. Associate the PHZ only with the Shared Services VPC. Deploy a single NAT Gateway in the Shared Services VPC to handle all outbound internet traffic from the spokes.
- Attach both the DXGW (via a transit Virtual Interface) and the Site-to-Site VPN to the TGW. Configure BGP to advertise the same on-premises network prefix over both paths. On the customer gateway, configure BGP local preference to prioritize the DX path. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC, configure on-premises DNS to forward queries for the AWS private domain to the inbound endpoints, and associate the PHZ with the Shared Services VPC and all spoke VPCs. Deploy redundant NAT Gateways across multiple Availability Zones in a centralized Egress VPC attached to the TGW.Answer
- DAttach both the DXGW and the VPN to the TGW. Configure static routes in the TGW route table for the on-premises prefix pointing to the DXGW attachment with a lower administrative distance, and another pointing to the VPN attachment with a higher administrative distance. Create a PHZ in the Shared Services VPC, do not associate it with the spoke VPCs, and configure on-premises DNS forwarders to point directly to the VPC resolver IP address of `` over the DX connection. Deploy redundant NAT Gateways in a centralized Egress VPC.