An enterprise is designing a highly available, multi-account hybrid network architecture a… — AWS Certified Solutions Architect - Professional

An enterprise is designing a highly available, multi-account hybrid network architecture across two AWS Regions: $us-east-1$ (the primary region) and $us-west-2$ (the secondary region). The enterprise has deployed spoke VPCs in multiple member accounts in both regions. The on-premises data center is connected to AWS via a $10\text{ Gbps}$ AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW). To ensure high availability, the enterprise plans to use an IPsec VPN connection as a backup path.

The design must satisfy the following requirements:
- All spoke VPCs in both regions must have access to the on-premises data center.
- The $10\text{ Gbps}$ DX path must be preferred for all hybrid traffic, and the VPN path must only be used in the event of a DX or regional Transit Gateway failure.
- Spoke VPCs must be able to securely resolve domain names hosted in the on-premises data center.
- The solution must minimize monthly operating costs and administrative overhead.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Associate the Direct Connect Gateway (DXGW) with the Transit Gateways (TGWs) in both regions. Establish backup IPsec VPN connections from the on-premises data center to the TGW in each region. Configure BGP on the customer gateway to advertise identical on-premises prefixes over both paths, utilizing AS-Path prepending on the VPN routes to ensure the DX path is preferred.Cevap
Deploy Route 53 Resolver outbound endpoints in a centralized network VPC. Create a forwarding rule for the on-premises domain pointing to the on-premises DNS servers, and share the rule across the AWS Organization using AWS Resource Access Manager (RAM). Associate the shared resolver rule and the on-premises private hosted zone with the spoke VPCs in all accounts.Cevap
C
Associate the Direct Connect Gateway (DXGW) with the Transit Gateway (TGW) in us-east-1 only. Establish a peered connection between the TGW in us-east-1 and the TGW in us-west-2. Configure the us-west-2 TGW route tables to route all hybrid traffic transitively through the peered connection to the us-east-1 TGW to access the DXGW.
D
Create a Route 53 Private Hosted Zone (PHZ) for the on-premises domain in the organization's management account. Rely on the organization-level DNS replication policy to automatically propagate DNS resolution capability for this PHZ to all member accounts and spoke VPCs without manual VPC association.
E
Centralize all outbound internet traffic from the spoke VPCs in both regions to a single egress VPC in us-east-1. Deploy a single NAT Gateway in one Availability Zone in the egress VPC to handle all outbound internet traffic, routing all internet-bound traffic from both regions through this single gateway to minimize provisioning costs.

Cevap

To configure a highly available and cost-effective hybrid network, associate the Direct Connect Gateway (DXGW) with the Transit Gateways (TGWs) in both regions and establish backup IPsec VPN connections on each TGW. Configure BGP on the customer gateway with AS-Path prepending on the VPN routes to ensure Direct Connect is preferred. For DNS, deploy centralized Route 53 Resolver outbound endpoints, create a forwarding rule, share the rule across the AWS Organization using AWS Resource Access Manager (RAM), and explicitly associate the rule and Private Hosted Zones with the spoke VPCs.

To establish highly available hybrid connectivity, the Direct Connect Gateway (DXGW) must be associated with the Transit Gateways (TGWs) in both regions. Establishing backup IPsec VPN connections to both TGWs and configuring AS-Path prepending on the VPN routes ensures that AWS prefers the Direct Connect path during normal operation and fails over gracefully to the VPN path. For DNS, Route 53 Resolver outbound endpoints and forwarding rules shared via AWS Resource Access Manager (RAM) allow spoke VPCs in all accounts to securely resolve on-premises domains. The forwarding rules and Private Hosted Zones must be explicitly associated with each spoke VPC to enable cross-account DNS resolution.

Adım Adım Çözüm

Configure the hybrid network infrastructure by associating the Direct Connect Gateway (DXGW) with the Transit Gateways in both the primary (us-east-1) and secondary (us-west-2) regions, allowing both regional TGWs to directly access the on-premises data center over the Direct Connect connection.

Direct Connect traffic routes directly from spoke VPCs in both regions to the on-premises environment without relying on transitive TGW peering routing, which is unsupported.

Direct TGW-to-DXGW associations are required because Transit Gateway peering does not support transitive routing to a DXGW attachment on a peered TGW.

Establish IPsec VPN connections from the customer gateway to the Transit Gateways in both regions to act as a backup path. Configure BGP routing on the customer gateway to prepended the AS-Path for all prefixes advertised over the VPN links compared to the DX links.

AWS naturally prefers the DX path over the VPN path due to BGP path attributes (specifically AS-Path length), utilizing VPN only when the DX connection or a TGW fails.

Prepending the AS-Path on the backup VPN routes ensures that the on-premises environment and AWS prefer the Direct Connect link during normal operations.

Set up centralized Route 53 Resolver outbound endpoints in a network VPC. Create a forwarding rule for the on-premises domain pointing to the on-premises DNS servers, share this rule using AWS RAM, and associate both the rule and any local Private Hosted Zones (PHZs) with all spoke VPCs across all member accounts.

Spoke VPCs across all accounts can successfully resolve on-premises DNS names securely and efficiently.

Private Hosted Zones and Route 53 Resolver rules are not automatically inherited at the organization level; they must be explicitly associated with each target VPC.

Anahtar Kavram

AWS Multi-Region Transit Gateway Routing and Cross-Account DNS Shared Architecture

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru