A retail company is expanding its AWS footprint across a multi-account environment in the `eu-west-1` and `eu-central-1` Regions. The architecture consists of spoke VPCs spread across both regions, all managed under a AWS Organizations structure. The company must establish highly resilient hybrid connectivity to its on-premises corporate offices in Dublin and Frankfurt.
The connectivity requirements are as follows:
- Traffic from the Dublin corporate office must primarily use a AWS Direct Connect (DX) connection to `eu-west-1`, with a backup Site-to-Site VPN connection.
- Traffic from the Frankfurt corporate office must primarily use a AWS Direct Connect (DX) connection to `eu-central-1`, with a backup Site-to-Site VPN connection.
- Inter-VPC traffic across the two regions must be routed securely through peered AWS Transit Gateways (TGWs) located in each region.
- Spoke VPCs in both regions must resolve internal domain names hosted in a centralized Route 53 Private Hosted Zone (PHZ) created in a shared services AWS account.
Which TWO configurations must a Solutions Architect implement to meet these requirements with high availability and minimal administrative overhead?
- ACreate a full mesh of VPC Peering connections across all spoke VPCs to handle cross-region and inter-VPC traffic. Deploy a Direct Connect Gateway in each region, establish Direct Connect Gateway peering between them, and route all hybrid traffic through these peered gateways.
- Attach a Transit Virtual Interface (Transit VIF) from each Direct Connect connection to a single Direct Connect Gateway, and associate this Direct Connect Gateway with the Transit Gateways in both regions. Configure AWS Site-to-Site VPN connections from each corporate office to the local Transit Gateway as a backup path.Cevap
- CDeploy Route 53 Resolver outbound endpoints in each spoke VPC. In the shared services account, create a Route 53 Resolver forwarding rule for the private hosted zone domain, and share it with the spoke accounts using AWS Resource Access Manager (RAM) to redirect queries to the spoke VPCs.
- Authorize the cross-account association of the Route 53 Private Hosted Zone in the shared services account with the spoke VPCs in both regions using the AWS CLI or SDK, and then complete the association in each spoke account.Cevap
- EDeploy a single NAT Gateway in a single public subnet in each spoke VPC, and configure the route tables of all private subnets in that VPC to route outbound internet traffic through this NAT Gateway to minimize cost.