A multinational financial corporation is designing a secure, high-availability hybrid network topology across two AWS Regions: `us-east-1` and `us-west-2`. The organization has 60 spoke VPCs distributed across multiple AWS accounts. The primary data centers are in New York and London. The architecture must satisfy the following constraints:
1. Primary connectivity must use AWS Direct Connect (DX) via two connections (one at a DX location near `us-east-1` and one near `us-west-2`).
2. High availability must be guaranteed via automated failover to backup Site-to-Site VPN connections over the public internet to each region. The VPN paths should only carry traffic if the local DX connection is down.
3. Spoke VPCs in both regions must be able to communicate with each other over the AWS network backbone.
4. Corporate users on-premises must be able to resolve private DNS names in an AWS Route 53 Private Hosted Zone (PHZ) hosted in a centralized Shared Services account. AWS resources must also resolve on-premises DNS records.
5. All outbound internet traffic from the spoke VPCs must be inspected by AWS Network Firewall in a centralized egress VPC in each region before routing to the internet, while avoiding single points of failure and minimizing inter-AZ data transfer costs.
Which architectural design and routing configuration meets these requirements?
- Deploy a Transit Gateway (TGW) in each region and establish a TGW peering connection between them. Attach the local spoke VPCs to their respective regional TGW. Create a single Direct Connect Gateway (DXGW), associate it with both TGWs, and attach a Transit VIF from each DX connection to the DXGW. Configure Site-to-Site VPN connections from on-premises to the TGW in each region. Advertise the on-premises prefix over BGP via both DX and VPN; the TGWs will automatically prefer the DXGW route over the VPN route. On the customer gateways, configure BGP local preference to prefer the DX routes over the VPN routes. Deploy a centralized egress VPC in each region with redundant NAT Gateways and Network Firewall endpoints across multiple Availability Zones, routing outbound traffic from the TGW through them. Deploy Route 53 Resolver Inbound and Outbound Endpoints in a Shared Services VPC. Share the on-premises DNS forwarding rules via AWS RAM and associate them with all VPCs, and associate the PHZ directly with all spoke VPCs.Cevap
- BDeploy a Transit Gateway (TGW) in each region and peer them. Attach spoke VPCs to their local TGW. Create a single Direct Connect Gateway (DXGW) associated with both TGWs, terminating Transit VIFs from both DX connections. Set up Site-to-Site VPN connections to the TGW in each region. Advertise the on-premises prefix via BGP over both DX and VPN. Use BGP AS-Path prepending on the VPN connection to force the TGWs to prefer the DXGW route for outbound traffic. In each egress VPC, deploy a single NAT Gateway in a single Availability Zone to minimize baseline hourly charges, routing all cross-AZ outbound internet traffic to this single NAT Gateway. Deploy Route 53 Resolver Inbound and Outbound Endpoints in a Shared Services VPC, share the forwarding rules via AWS RAM, and associate the PHZ directly with all spoke VPCs.
- CDeploy a Transit Gateway (TGW) in each region. Attach local spoke VPCs to their local TGW. Create two separate Direct Connect Gateways (DXGWs)—one for each region—and associate each with its local TGW. Configure the DXGWs to route traffic transitively through the on-premises data centers to enable spoke-to-spoke communication between regions. Set up backup Site-to-Site VPN connections to each TGW. On the customer gateways, configure BGP local preference to prefer the DX routes. Deploy a centralized egress VPC in each region with redundant NAT Gateways across multiple Availability Zones. In the Shared Services VPC, deploy Route 53 Resolver Inbound Endpoints. In each spoke VPC, create a Route 53 Resolver forwarding rule pointing to the Inbound Endpoint IP addresses to resolve private DNS names in the PHZ.
- DDeploy a Transit Gateway (TGW) in each region and peer them. Attach local spoke VPCs to their local TGW. Create a single Direct Connect Gateway (DXGW) associated with both TGWs, terminating Transit VIFs from both DX connections. Configure Site-to-Site VPN connections from on-premises to the TGW in each region. Advertise the on-premises prefix over BGP via both DX and VPN, using local preference on customer gateways to prefer DX. Deploy a centralized egress VPC in each region with redundant NAT Gateways across multiple Availability Zones. In the Shared Services account, deploy Route 53 Resolver Inbound and Outbound Endpoints. Create a Route 53 Resolver forwarding rule for the PHZ's domain pointing to the Inbound Endpoint IP addresses, share this rule via AWS RAM, and associate it with all spoke VPCs across all accounts.