A logistics enterprise is establishing a new platform across multiple AWS accounts in the eu-central-1 Region. The architecture requires three production spoke VPCs (vpc-delivery-prod, vpc-warehouse-prod, and vpc-tracking-prod) to communicate with one another for real-time inventory updates. Additionally, these spoke VPCs must connect to the corporate on-premises network via a 10 Gbps AWS Direct Connect connection. The enterprise also requires secure, highly available outbound internet access for all spokes to download software patches, and name resolution for a private DNS zone (corp.internal) hosted in a central shared services account. Which architecture should a solutions architect recommend to satisfy these requirements while preventing single points of failure and minimizing administrative overhead?
- Deploy an AWS Transit Gateway and attach the three spoke VPCs, the shared services VPC, and a dedicated egress VPC to it. Associate the Direct Connect Gateway with the Transit Gateway to enable hybrid connectivity. In the egress VPC, deploy NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route tables to route all outbound internet traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone corp.internal with all spoke VPCs, the shared services VPC, and the egress VPC.Cevap
- BDeploy a Direct Connect Gateway and associate the three spoke VPCs and the shared services VPC directly with the Direct Connect Gateway to enable spoke-to-spoke communication and hybrid connectivity. In a dedicated egress VPC, deploy a single NAT Gateway in a single Availability Zone, and configure VPC peering connections from each spoke VPC to the egress VPC for outbound internet access. Associate the private hosted zone corp.internal only with the shared services VPC.
- CDeploy an AWS Transit Gateway and attach the three spoke VPCs, the shared services VPC, and a dedicated egress VPC to it. Associate the Direct Connect Gateway with the Transit Gateway. In the egress VPC, deploy a single NAT Gateway in one Availability Zone to centralize and simplify outbound traffic paths, and configure the Transit Gateway route tables to route all outbound internet traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone corp.internal with all spoke VPCs, the shared services VPC, and the egress VPC.
- DDeploy an AWS Transit Gateway and attach the three spoke VPCs, the shared services VPC, and a dedicated egress VPC to it. Associate the Direct Connect Gateway with the Transit Gateway. In the egress VPC, deploy NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route tables to route all outbound internet traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone corp.internal only with the shared services VPC, relying on Transit Gateway routing to forward DNS queries from the spoke VPCs to the shared services DNS endpoints.