An enterprise is designing a new multi-VPC application in the eu-west-1 Region. The architecture consists of two spoke VPCs (vpc-app-prod and vpc-db-prod) and a centralized egress VPC (vpc-egress-prod). All VPCs are deployed across three Availability Zones. Outbound internet traffic from the spoke VPCs must be securely routed through the egress VPC. Additionally, instances in the spoke VPCs must resolve private DNS names hosted in a Route 53 Private Hosted Zone (PHZ) named corp.internal, which is managed in a separate Shared Services AWS account. The solution must ensure high availability across all Availability Zones.
Which of the following configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Deploy one NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC. Configure the spoke VPC route tables to route all 0.0.0.0/0 traffic to the Transit Gateway, and configure the Transit Gateway route tables to route egress traffic to the egress VPC.Cevap
- Create a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs. Accept the association for each spoke VPC from their respective accounts to allow local resolution of the private DNS names.Cevap
- CDeploy a single NAT Gateway in one Availability Zone in the public subnet of the centralized egress VPC to handle all outbound traffic from the spoke VPCs, routing traffic from all Availability Zones in the spoke VPCs to this single NAT Gateway to minimize running costs.
- DConfigure a Route 53 Resolver outbound endpoint in the spoke VPCs with rules to forward queries for corp.internal to the Route 53 Resolver inbound endpoint in the Shared Services VPC, rather than associating the Private Hosted Zone with the spoke VPCs.
- EConnect the spoke VPCs and the egress VPC to a Direct Connect Gateway to handle transitive routing between the VPCs, bypassing the need for an AWS Transit Gateway to establish interconnectivity.
Cevap
Deploy one NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC, and create a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs, accepting the association for each spoke VPC from their respective accounts.
The correct architecture requires deploying a NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC to ensure egress high availability, satisfying the requirement to survive an Availability Zone outage. It also requires creating a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs and accepting the association from the spoke accounts, allowing cross-account DNS resolution.
Adım Adım Çözüm
Anahtar Kavram
Designing resilient egress architecture with multi-AZ NAT Gateways and setting up cross-account Route 53 Private Hosted Zone VPC associations.