An enterprise has a multi-tier application deployed across two VPCs in the same AWS Region… — AWS Certified Solutions Architect - Professional

An enterprise has a multi-tier application deployed across two VPCs in the same AWS Region: a production VPC and a shared services VPC. The production VPC has private subnets across two Availability Zones hosting a fleet of Amazon EC2 instances that process approximately $600\text{ TB}$ of data monthly. This data includes high-volume exchanges with the shared services VPC via an AWS Transit Gateway, as well as read/write operations to Amazon S3 and Amazon DynamoDB. Currently, all outbound traffic, including S3 and DynamoDB traffic, is routed through two active NAT Gateways (one in each Availability Zone) in the production VPC. The enterprise needs to reduce its data transfer and processing costs while maintaining high availability and avoiding any application code changes. Which of the following architectural changes should the Solutions Architect recommend to achieve these goals cost-effectively? (Select TWO.)

Create VPC gateway endpoints for Amazon S3 and Amazon DynamoDB in the production VPC and associate them with the private subnet route tables.Answer
Establish a VPC Peering connection between the production VPC and the shared services VPC, and update the private subnet route tables to route inter-VPC traffic through this connection.Answer
C
Consolidate outbound traffic by routing all internet and AWS service traffic from both Availability Zones through a single NAT Gateway located in one of the public subnets.
D
Configure a Direct Connect Gateway between the production VPC and the shared services VPC to bypass the Transit Gateway and route inter-VPC traffic over the private network.
E
Order an AWS Snowball Edge Storage Optimized device to store intermediate S3 data locally and physically transfer it to the shared services account to eliminate network fees.

Answer

Create VPC gateway endpoints for Amazon S3 and Amazon DynamoDB in the production VPC and associate them with the private subnet route tables, and establish a VPC Peering connection between the production VPC and the shared services VPC, and update the private subnet route tables to route inter-VPC traffic through this connection.

The correct options recommend establishing VPC gateway endpoints for Amazon S3 and Amazon DynamoDB, and setting up a VPC Peering connection between the two VPCs. Implementing VPC gateway endpoints routes S3 and DynamoDB traffic directly from the private subnets without going through the NAT Gateways, eliminating the

0.045/GB NAT Gateway data processing fee. Setting up a VPC Peering connection for traffic between the production VPC and the shared services VPC avoids the

0.02/GB AWS Transit Gateway data processing charges, as same-Region VPC Peering does not charge data processing fees. Together, these steps optimize data transfer costs while maintaining a highly available, multi-AZ setup without requiring application code changes.

Step-by-Step Solution

Analyze the sources of data transfer costs in the current architecture.

Identify that

600\text{ TB}

of traffic is passing through NAT Gateways and Transit Gateway, incurring significant data processing charges (

0.045/GB for NAT Gateway and

0.02/GB for Transit Gateway).

To optimize costs, we must address the highest contributors to the bill: the S3/DynamoDB traffic passing through NAT Gateways, and the inter-VPC traffic passing through Transit Gateway.

Evaluate S3 and DynamoDB data paths for cost reduction.

Recommend creating VPC gateway endpoints for S3 and DynamoDB in the production VPC.

Gateway endpoints route traffic directly to S3 and DynamoDB without passing through NAT Gateways, eliminating the $0.045/GB NAT Gateway processing fee. Since gateway endpoints are free, this provides immediate and complete savings for this traffic flow.

Evaluate the inter-VPC data path for cost reduction.

Recommend establishing a VPC Peering connection between the production VPC and the shared services VPC.

Transit Gateway charges $0.02/GB for data processing. Setting up VPC Peering within the same Region eliminates these processing fees because VPC Peering traffic incurs no processing costs, only standard intra-Region data transfer costs if crossing Availability Zones.

Key Concept

Minimizing data transfer and processing costs by replacing Transit Gateway with VPC Peering for intra-Region traffic and using VPC gateway endpoints for S3 and DynamoDB to bypass NAT Gateways.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics