A media company is reviewing the network architecture of its analytics platform in the us-… — AWS Certified Solutions Architect - Associate

A media company is reviewing the network architecture of its analytics platform in the us-east-1 Region. The architecture consists of a primary processing VPC (VPC A) containing EC2 instances in private subnets, and a data warehouse VPC (VPC B) containing an Amazon Redshift cluster.

The EC2 instances in VPC A perform the following network operations monthly:
- Download $80\text{ TB}$ of raw datasets from an Amazon S3 bucket located in the us-east-1 Region.
- Upload $20\text{ TB}$ of cleansed datasets back to the same Amazon S3 bucket.
- Query and load $40\text{ TB}$ of aggregated results into the Amazon Redshift cluster in VPC B.
- Download $500\text{ GB}$ of software patches from external public internet repositories.

Currently, VPC A and VPC B are connected via an AWS Transit Gateway. The private subnets in VPC A route all non-VPC traffic ( $0.0.0.0/0$ ) through a NAT Gateway in a public subnet of VPC A.

Which network architecture configuration will meet these requirements while minimizing data transfer and routing costs?

Configure a Gateway VPC Endpoint for Amazon S3 in VPC A. Establish a VPC Peering connection between VPC A and VPC B, and configure the route tables to route traffic between the two VPCs through the VPC Peering connection. Retain the NAT Gateway in VPC A for external internet traffic.Cevap
B
Keep the existing AWS Transit Gateway connection and the NAT Gateway in VPC A. Route all Amazon S3 traffic through the NAT Gateway and route the database traffic to VPC B through the AWS Transit Gateway.
C
Establish a VPC Peering connection between VPC A and VPC B to route database traffic. Replace the NAT Gateway in VPC A with an Interface VPC Endpoint for Amazon S3, routing all S3 traffic through the Interface Endpoint, and configure a Network ACL to bypass data processing charges for S3 traffic.
D
Configure a Gateway VPC Endpoint for Amazon S3 in VPC A. Route database traffic to VPC B over a new AWS Site-to-Site VPN connection established between the two VPCs to avoid Transit Gateway costs, and route external internet traffic through the VPN connection.

Cevap

Configure a Gateway VPC Endpoint for Amazon S3 in VPC A. Establish a VPC Peering connection between VPC A and VPC B, and configure the route tables to route traffic between the two VPCs through the VPC Peering connection. Retain the NAT Gateway in VPC A for external internet traffic.

The correct architecture uses a Gateway VPC Endpoint for Amazon S3, which eliminates all NAT Gateway data processing charges for the

100\text{ TB}

of monthly S3 traffic because Gateway Endpoints are free. It also replaces the AWS Transit Gateway connection for inter-VPC database traffic with a VPC Peering connection, which removes the Transit Gateway data processing fee of

\$0.02

per GB. The NAT Gateway is kept only for the low-volume

500\text{ GB}

of external internet traffic, keeping NAT Gateway costs minimal.

Adım Adım Çözüm

Analyze Amazon S3 traffic and costs.

Amazon S3 downloads and uploads total

100\text{ TB}

monthly. Routing this through the NAT Gateway costs

100 \times 1,024 \times 0.045 = \$4,608

in data processing fees.

Identifying the largest cost driver allows prioritizing the most effective solution, which is deploying a free S3 Gateway VPC Endpoint.

Analyze inter-VPC traffic and costs.

Database load traffic to VPC B totals

40\text{ TB}

monthly. Routing this through the AWS Transit Gateway costs

40 \times 1,024 \times 0.02 = \$819.20

in data processing fees.

Comparing Transit Gateway fees to VPC Peering (which has no data processing fees) shows that VPC Peering is significantly cheaper for high-throughput regional traffic.

Evaluate internet patch download requirements.

Patch traffic is only

500\text{ GB}

monthly, costing

500 \times 0.045 = \$22.50

via NAT Gateway.

Since the volume is very small, keeping the NAT Gateway for external internet traffic is cost-effective and avoids complex architectures.

Anahtar Kavram

Selecting the most cost-effective network routing path by replacing NAT Gateways and AWS Transit Gateway with Gateway VPC Endpoints and VPC Peering for high-volume internal data transfers.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular