A multinational enterprise is integrating two AWS Organizations following an acquisition. Organization A has a hub-and-spoke network in the us-east-1 Region centered around an AWS Transit Gateway (TGW-A). TGW-A connects to the on-premises datacenter using an existing 10 Gbps AWS Direct Connect (DX) connection with a Direct Connect Gateway (DXGW) and a Transit Virtual Interface (Transit VIF).
Organization B has its own AWS Organization with an independent Transit Gateway (TGW-B) in the us-east-1 Region, connecting multiple spoke VPCs and a Shared Services VPC.
A solutions architect must design a hybrid connectivity and DNS architecture for Organization B that meets the following requirements:
- Primary hybrid path: Use the existing DX connection in Organization A.
- Backup hybrid path: Implement an AWS Site-to-Site VPN over the internet to TGW-B with automatic failover.
- Network Isolation: Spoke VPCs in Organization B must not communicate with VPCs in Organization A, but both must communicate with the on-premises datacenter.
- Centralized Egress: All internet-bound (0.0.0.0/0) traffic from Organization B's spoke VPCs must route through an Egress VPC in Organization B. The design must minimize costs while ensuring high availability across multiple Availability Zones (AZs).
- Name Resolution: Spoke VPCs in Organization B must resolve DNS queries for internal services hosted in a Route 53 Private Hosted Zone (PHZ) managed within the Shared Services VPC.
Which architecture should the solutions architect design to meet these requirements?
- AEstablish a Transit Gateway peering connection between TGW-A and TGW-B, routing hybrid traffic from Organization B through TGW-A to the DXGW. Deploy an AWS Site-to-Site VPN from the customer gateway to TGW-B for backup. In the Egress VPC, deploy redundant NAT Gateways across two AZs and configure TGW-B to route internet traffic through them. Rely on TGW-B attachment routing to allow spoke VPCs in Organization B to automatically resolve DNS queries from the Route 53 Private Hosted Zone in the Shared Services VPC without manual association.
- Submit a cross-account association proposal from Organization B to associate TGW-B with the DXGW, and accept it in Organization A. Deploy an AWS Site-to-Site VPN from the customer gateway to TGW-B, configuring BGP routing with AS Path prepending on the VPN path to make it the backup. In the Egress VPC, deploy a NAT Gateway in each of the two active AZs, and configure private route tables to route internet traffic to their local NAT Gateway. Associate the Route 53 Private Hosted Zone in the Shared Services VPC with all spoke VPCs in Organization B.Cevap
- CAssociate TGW-B with the DXGW by submitting and accepting a cross-account association proposal. Deploy an AWS Site-to-Site VPN from the customer gateway to TGW-B for backup. In the Egress VPC, deploy a single NAT Gateway in a single AZ, and configure the route tables in all private subnets across both AZs to point to this single NAT Gateway to reduce running costs. Associate the Route 53 Private Hosted Zone in the Shared Services VPC with all spoke VPCs in Organization B.
- DEstablish a Transit Gateway peering connection between TGW-A and TGW-B, routing all on-premises traffic from Organization B's spoke VPCs through TGW-A. Deploy an AWS Site-to-Site VPN from the customer gateway to TGW-B for backup. In the Egress VPC, deploy redundant NAT Gateways across two AZs. Associate the Route 53 Private Hosted Zone in the Shared Services VPC with all spoke VPCs in Organization B.