An enterprise is designing a new multi-account network topology in the `ap-southeast-1` re… — AWS Certified Solutions Architect - Professional

An enterprise is designing a new multi-account network topology in the `ap-southeast-1` region. The architecture includes two spoke VPCs, `vpc-ap-southeast1-frontend` (CIDR $172.16.10.0/24$ ) and `vpc-ap-southeast1-backend` (CIDR $172.16.20.0/24$ ), and a centralized egress VPC, `vpc-ap-southeast1-egress` (CIDR $172.16.30.0/24$ ). An on-premises data center must connect to the VPCs via a 10 Gbps AWS Direct Connect connection. The architecture has the following constraints:

1. Spoke VPCs must not have direct internet access; all outbound internet traffic ( $0.0.0.0/0$ ) must route through the egress VPC, which must be resilient to Availability Zone outages.
2. Spoke VPCs must resolve DNS queries for `corp.internal`, which is a Route 53 Private Hosted Zone managed in a separate Shared Services AWS account.
3. Administrative overhead must be minimized.

Which network architecture meets these requirements while satisfying all constraints?

A
Deploy a Transit Gateway (TGW) and attach `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` to it. In `vpc-ap-southeast1-egress`, deploy redundant NAT Gateways across two Availability Zones. Share the `corp.internal` Private Hosted Zone from the Shared Services account using AWS Resource Access Manager (RAM) to allow automatic cross-account DNS resolution for the spoke VPCs.
Deploy a Transit Gateway (TGW) and attach `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` to it. In `vpc-ap-southeast1-egress`, deploy redundant NAT Gateways across two Availability Zones in public subnets. Associate the `corp.internal` Private Hosted Zone in the Shared Services account with the spoke and egress VPCs by creating VPC association authorizations in the Shared Services account and accepting them in the spoke and egress accounts.Answer
C
Deploy a Transit Gateway (TGW) and attach all VPCs to it. In `vpc-ap-southeast1-egress`, deploy a single NAT Gateway in the `ap-southeast-1a` Availability Zone. Configure the private subnet route tables of the spoke VPCs to route outbound internet traffic ( $0.0.0.0/0$ ) to the TGW. Associate the `corp.internal` Private Hosted Zone in the Shared Services account with the spoke and egress VPCs using cross-account VPC association authorizations.
D
Deploy a Direct Connect Gateway (DXGW) connected to the on-premises environment. Attach `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` directly to the DXGW. Configure Virtual Private Gateways (VGWs) in each VPC, and use the DXGW to route spoke-to-spoke, spoke-to-on-premises, and outbound internet traffic through the NAT Gateways in the egress VPC. Associate the `corp.internal` Private Hosted Zone in the Shared Services account with the spoke and egress VPCs using cross-account VPC association authorizations.

Answer

The correct network architecture deploys a Transit Gateway to interconnect the VPCs, deploys redundant NAT Gateways across multiple Availability Zones in the egress VPC to prevent a single point of failure, and utilizes cross-account Private Hosted Zone association authorizations to allow the spoke VPCs to resolve DNS queries managed in the Shared Services account.

The correct answer provides a highly available, transitive, and correct DNS routing topology. Transit Gateway is used to interconnect the VPCs. In the egress VPC, redundant NAT Gateways across two Availability Zones prevent a single point of failure. The Route 53 Private Hosted Zone in the Shared Services account is correctly associated with the spoke VPCs using cross-account association authorizations, which is the only valid way to map a PHZ across multiple accounts without setting up custom DNS forwarding architectures.

Step-by-Step Solution

Determine the routing mechanism for centralized egress and hybrid connectivity.

A Transit Gateway (TGW) must be deployed to interconnect `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` and route traffic transitively.

Direct Connect Gateway (DXGW) alone does not support transitive VPC-to-VPC routing or VPC-to-internet routing.

Design the high-availability NAT Gateway configuration.

Deploy redundant NAT Gateways in public subnets across two different Availability Zones in the central egress VPC.

Deploying a single NAT Gateway introduces a single point of failure, violating the high-availability constraint during an Availability Zone outage.

Determine the cross-account Private Hosted Zone (PHZ) sharing strategy.

Create a VPC association authorization for the spoke VPCs from the Shared Services account, and then accept the association in the spoke accounts.

Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager (RAM).

Key Concept

Centralized egress architectures, transitive routing limitations of Direct Connect Gateway, and cross-account Route 53 Private Hosted Zone associations.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic