An enterprise is designing a highly resilient hybrid network architecture for its multi-account AWS environment. The environment consists of VPCs distributed across two AWS Regions: `us-east-1` ( VPCs) and `eu-west-1` ( VPCs). The enterprise needs to establish redundant connectivity to its primary on-premises data center in London.
The network design must meet the following requirements:
- Establish a primary, high-bandwidth path using a AWS Direct Connect (DX) connection.
- Establish a backup IPsec VPN connection over the public internet.
- Minimize administrative overhead for managing routing tables.
- Support transitive routing between the VPCs in both regions and the on-premises data center.
- Ensure that the Direct Connect path is preferred for both inbound and outbound traffic, with automatic failover to the VPN connection in the event of a Direct Connect outage.
Which of the following architectures meets these requirements?
- Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and establish a TGW peering connection between them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Configure BGP routing on all connections, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect Gateway.Cevap
- BDeploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and peer them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating only on the `eu-west-1` TGW. Configure BGP routing on all connections, and rely on the TGW peering connection to route `us-east-1` traffic to the `eu-west-1` TGW's VPN attachment during a Direct Connect outage.
- CDeploy a Direct Connect Gateway (DXGW) and associate it directly with all Virtual Private Gateways (VGWs) of the VPCs across both regions. Terminate a Private VIF from the Direct Connect connection on the DXGW. For the backup path, establish an AWS Site-to-Site VPN connection to each individual VPC's VGW. Configure BGP routing on all VGWs to manage failover dynamically, preferring the Direct Connect path using BGP community tags.
- DDeploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and peer them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Associate a single Route 53 Private Hosted Zone (PHZ) for the on-premises domain with a central Shared Services VPC in `eu-west-1`, and rely on the TGW peering connection to automatically resolve on-premises DNS queries for all VPCs in both regions.