A company is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 12 spoke VPCs in a single AWS Region, a shared services VPC, and an on-premises data center. The company requires:
- Hybrid connectivity from all VPCs to the on-premises data center using an existing AWS Direct Connect connection.
- Private DNS resolution for an on-premises domain, `corp.internal`, from all spoke VPCs.
- High-availability outbound internet connectivity for workloads running in the spoke VPCs.
Which combination of steps should a solutions architect recommend to meet these requirements with the least administrative overhead?
- Deploy an AWS Transit Gateway, attach all spoke VPCs and the shared services VPC to it, and associate the Transit Gateway with a Direct Connect Gateway. Create a Route 53 Resolver outbound endpoint in the shared services VPC, create a forwarding rule for the `corp.internal` domain, and associate the rule with all VPCs. Deploy redundant NAT Gateways across multiple Availability Zones in the shared services VPC, directing spoke egress traffic to these NAT Gateways via the Transit Gateway.Cevap
- BAssociate all 12 spoke VPCs directly with the Direct Connect Gateway to establish hybrid connectivity, and configure a full mesh of VPC peering connections for inter-VPC routing. Deploy a Route 53 Resolver outbound endpoint in the shared services VPC without associating the forwarding rule to other VPCs. Deploy a single NAT Gateway in the shared services VPC for egress traffic.
- CDeploy an AWS Transit Gateway, attach all spoke VPCs and the shared services VPC, and associate the Transit Gateway with the Direct Connect Gateway. Create a Route 53 Private Hosted Zone for `corp.internal` in the shared services account, but do not associate it with the spoke VPCs, relying on the Transit Gateway to route DNS queries to the shared services VPC. Deploy redundant NAT Gateways across multiple Availability Zones in the shared services VPC.
- DDeploy an AWS Transit Gateway, attach all spoke VPCs and the shared services VPC, and associate the Transit Gateway with the Direct Connect Gateway. Create a Route 53 Resolver outbound endpoint in the shared services VPC and associate the forwarding rule for `corp.internal` with all VPCs. Deploy a single NAT Gateway in one Availability Zone within the shared services VPC, and configure the spoke VPC route tables to direct all outbound internet traffic to this NAT Gateway via the Transit Gateway.
Cevap
Deploy an AWS Transit Gateway, attach all spoke VPCs and the shared services VPC to it, and associate the Transit Gateway with a Direct Connect Gateway. Create a Route 53 Resolver outbound endpoint in the shared services VPC, create a forwarding rule for the `corp.internal` domain, and associate the rule with all VPCs. Deploy redundant NAT Gateways across multiple Availability Zones in the shared services VPC, directing spoke egress traffic to these NAT Gateways via the Transit Gateway.
The correct solution uses AWS Transit Gateway to interconnect all spoke VPCs and the shared services VPC, and connects to the on-premises data center via a Direct Connect Gateway. Centralized DNS resolution is achieved by configuring a Route 53 Resolver outbound endpoint and associating the forwarding rule with all VPCs. High-availability egress traffic is managed using redundant NAT Gateways across multiple Availability Zones in the shared services VPC.
Adım Adım Çözüm
Anahtar Kavram
Centralized hybrid networking, DNS resolution, and egress control using AWS Transit Gateway, Route 53 Resolver, and redundant NAT Gateways.