A financial services company is designing a secure, multi-VPC networking architecture in the eu-west-1 region for a new application. The design includes two VPCs: vpc-app-prod (hosting critical production workloads across two Availability Zones) and vpc-shared-services (hosting shared monitoring tools).
The architecture must meet the following requirements:
1. Workloads in the private subnets of vpc-app-prod must have highly available outbound-only internet access, ensuring no single point of failure.
2. The monitoring tools in vpc-shared-services must be able to resolve domain names in the private hosted zone prod.corp.aws, which is managed in the production environment.
Which design architecture meets these requirements?
- Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod. Update the route tables of the private subnets in each Availability Zone to route outbound internet traffic through the NAT Gateway in the same Availability Zone. Associate the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services.Cevap
- BDeploy a single NAT Gateway in a public subnet within one Availability Zone of vpc-app-prod. Update the route tables of the private subnets in all Availability Zones of vpc-app-prod to route outbound internet traffic through this single NAT Gateway. Associate the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services.
- CDeploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod. Update the route tables of the private subnets in each Availability Zone to route outbound internet traffic through the NAT Gateway in the same Availability Zone. Associate the Route 53 Private Hosted Zone prod.corp.aws only with vpc-app-prod, relying on the VPC peering connection between the two VPCs to transitively resolve DNS names.
- DDeploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod. Connect vpc-app-prod and vpc-shared-services using an AWS Direct Connect Gateway to enable transitive VPC-to-VPC routing of outbound traffic and DNS requests. Associate the Route 53 Private Hosted Zone prod.corp.aws with the Direct Connect Gateway.
Cevap
Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod, route the private subnets in each Availability Zone to their respective local NAT Gateways, and associate the Route 53 Private Hosted Zone prod.corp.aws with both VPCs.
The correct architecture deploys a NAT Gateway in a public subnet within each Availability Zone of vpc-app-prod. This ensures that outbound internet traffic from the private subnets is highly available and does not depend on a single Availability Zone. Additionally, associating the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services allows resources in both VPCs to resolve DNS queries for that zone directly via the Route 53 Resolver.
Adım Adım Çözüm
Anahtar Kavram
Multi-AZ NAT Gateway redundancy and multi-VPC Route 53 Private Hosted Zone association.
Tahmini Süre:2m 0s