An enterprise is designing a new AWS networking architecture in the us-west-2 region consisting of three spoke VPCs (vpc-prod-app, vpc-prod-web, and vpc-prod-data) and one centralized services VPC (vpc-shared-services). The shared services VPC hosts a Route 53 Private Hosted Zone (PHZ) named corp.aws. The architecture requires that the spoke VPCs can resolve DNS queries for corp.aws and route all outbound internet traffic through a centralized egress VPC (vpc-central-egress) using NAT Gateways. The solution must ensure high availability for outbound traffic across two Availability Zones and minimize administrative overhead. Which of the following designs best satisfies these requirements?
- Deploy an AWS Transit Gateway named tgw-core and attach all four VPCs to it. Create two NAT Gateways in vpc-central-egress, with one located in public-subnet-1a (Availability Zone AZ-A) and the other in public-subnet-1b (Availability Zone AZ-B). Configure private route tables in vpc-central-egress to direct internet traffic () to the NAT Gateway in the same Availability Zone. Update the Transit Gateway route tables to route all outbound internet traffic from the spokes to vpc-central-egress. Associate the corp.aws Route 53 Private Hosted Zone with the shared services VPC and all three spoke VPCs.Cevap
- BDeploy an AWS Transit Gateway named tgw-core and attach all four VPCs to it. Create a single NAT Gateway in vpc-central-egress, located in public-subnet-1a (Availability Zone AZ-A). Configure all private route tables in vpc-central-egress to direct all internet traffic () to this single NAT Gateway. Update the Transit Gateway route tables to route all outbound internet traffic from the spokes to vpc-central-egress. Associate the corp.aws Route 53 Private Hosted Zone with the shared services VPC and all three spoke VPCs.
- CDeploy an AWS Transit Gateway named tgw-core and attach all four VPCs to it. Create two NAT Gateways in vpc-central-egress, with one located in public-subnet-1a (Availability Zone AZ-A) and the other in public-subnet-1b (Availability Zone AZ-B). Configure private route tables in vpc-central-egress to direct internet traffic () to the NAT Gateway in the same Availability Zone. Update the Transit Gateway route tables to route all outbound internet traffic from the spokes to vpc-central-egress. Associate the corp.aws Route 53 Private Hosted Zone only with vpc-shared-services, relying on the Transit Gateway attachments to transitively resolve DNS queries from the spoke VPCs.
- DDeploy an AWS Direct Connect Gateway named dxgw-core and establish private virtual interfaces to connect all four VPCs. Create two NAT Gateways in vpc-central-egress, with one located in public-subnet-1a (Availability Zone AZ-A) and the other in public-subnet-1b (Availability Zone AZ-B). Route spoke-to-spoke and internet-bound traffic () through the Direct Connect Gateway. Associate the corp.aws Route 53 Private Hosted Zone with the shared services VPC and all three spoke VPCs.
Cevap
Deploy AWS Transit Gateway, configure dual NAT Gateways in the egress VPC across different Availability Zones, route spoke egress traffic through the egress VPC, and associate the Route 53 Private Hosted Zone with all spoke VPCs.
The correct architecture uses AWS Transit Gateway to centralize transit routing, deploys redundant NAT Gateways across two Availability Zones to prevent a single point of failure, and explicitly associates the Private Hosted Zone with all spoke VPCs to allow DNS resolution across the accounts.
Adım Adım Çözüm
Anahtar Kavram
Centralized, resilient egress networking using AWS Transit Gateway and multi-AZ NAT Gateways combined with Route 53 Private Hosted Zone cross-VPC association.