A multinational enterprise is designing a hybrid network architecture to connect spoke VPCs across multiple AWS accounts in the `us-east-1` Region to an on-premises data center. The company has the following requirements:
1. High availability for all outbound internet traffic from the spoke VPCs.
2. Secure private DNS resolution of resources in a centralized Shared Services VPC from all other spoke VPCs.
3. High-bandwidth primary connectivity via AWS Direct Connect with an IPsec VPN failover for on-premises hybrid traffic, using dynamic routing with automatic failover.
Which of the following actions should the solutions architect take to implement this architecture? (Select TWO.)
- Associate the AWS Transit Gateway with a Direct Connect Gateway using a transit virtual interface for the primary path, establish an AWS Site-to-Site VPN connection directly to the Transit Gateway as the backup path, and advertise the same on-premises routes via BGP over both paths.Cevap
- Deploy a NAT Gateway in each Availability Zone of a centralized egress VPC, and associate the centralized Route 53 Private Hosted Zone with all spoke VPCs using cross-account VPC associations.Cevap
- CConnect the spoke VPCs directly to the Direct Connect Gateway using Virtual Private Gateways to route VPC-to-VPC traffic transitively, and configure a Site-to-Site VPN with static routing on the Transit Gateway as the backup path.
- DCreate a centralized Route 53 Private Hosted Zone in the Shared Services AWS account, and configure a Transit Gateway route table rule to automatically forward DNS queries on port from the spoke VPCs to the Shared Services VPC.
- EDeploy a single NAT Gateway in a public subnet of one Availability Zone in a centralized egress VPC, and configure the route tables of all private subnets in the spoke VPCs to route traffic to this NAT Gateway.
Cevap
To implement this architecture, the solutions architect should associate the AWS Transit Gateway with a Direct Connect Gateway using a transit virtual interface for the primary path, establish an AWS Site-to-Site VPN connection to the Transit Gateway for the backup path, advertise the same routes via BGP over both paths, deploy a NAT Gateway in each Availability Zone of a centralized egress VPC, and associate the centralized Route 53 Private Hosted Zone with all spoke VPCs using cross-account VPC associations.
Associating the AWS Transit Gateway with a Direct Connect Gateway using a transit virtual interface establishes the high-bandwidth primary path. Terminating the Site-to-Site VPN on the same Transit Gateway and advertising the same BGP routes over both paths enables dynamic failover, as AWS Transit Gateway automatically prefers the Direct Connect gateway attachment over the VPN attachment for identical prefixes. For outbound high availability, deploying a NAT Gateway in each Availability Zone of a centralized egress VPC prevents a single Availability Zone outage from disrupting outbound traffic. Associating the centralized Route 53 Private Hosted Zone with all spoke VPCs enables seamless cross-account private DNS resolution.
Adım Adım Çözüm
Anahtar Kavram
Designing highly available, scalable hybrid network connectivity and centralized services routing using AWS Transit Gateway, multi-AZ NAT Gateways, and cross-account Route 53 Private Hosted Zone associations.