A company is designing a new cloud infrastructure in the us-east-1 Region. The architecture features an application VPC (vpc-prod-app, CIDR ) containing instances distributed across three Availability Zones (us-east-1a, us-east-1b, and us-east-1c) in private subnets. The instances require outbound-only internet access to retrieve security updates. The design must be highly available and resilient to Availability Zone failures, while minimizing data transfer charges. Additionally, the instances must resolve private domain names in the corp.internal Route 53 private hosted zone, which is hosted in a separate centralized AWS Services account. Which of the following designs should a solutions architect recommend to meet these requirements?
- Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Configure the route table of each private subnet to route outbound internet traffic () to the NAT Gateway in the same Availability Zone. Create a VPC association authorization from the centralized AWS Services account, and associate the corp.internal private hosted zone with vpc-prod-app.Cevap
- BDeploy a single NAT Gateway in a public subnet in us-east-1a. Configure the route tables of all private subnets to route outbound internet traffic () to this single NAT Gateway. Create a VPC association authorization from the centralized AWS Services account, and associate the corp.internal private hosted zone with vpc-prod-app.
- CDeploy a NAT Gateway in a public subnet in each of the three Availability Zones. Configure the route table of each private subnet to route outbound internet traffic () to the NAT Gateway in the same Availability Zone. In the centralized AWS Services account, deploy Route 53 Resolver outbound endpoints, and configure a forwarding rule for corp.internal pointing to the AWS-provided DNS IP address () of vpc-prod-app without associating the private hosted zone.
- DDeploy a single NAT Gateway in a centralized transit VPC. Connect vpc-prod-app to the transit VPC using an AWS Transit Gateway, and route all outbound internet traffic () through the Transit Gateway. Rely on the default AWS-provided DNS () in vpc-prod-app to resolve corp.internal without performing any cross-account associations.
Cevap
Deploy a NAT Gateway in a public subnet in each of the three Availability Zones, configure the private subnets to route outbound traffic to their local NAT Gateway, and create a cross-account VPC association for the Route 53 private hosted zone.
The correct design deploys a NAT Gateway in each Availability Zone to ensure high availability and prevent cross-AZ data transfer charges for egress traffic. For DNS resolution, a cross-account Route 53 Private Hosted Zone association is established by authorizing the association from the owner account and accepting/associating it from the VPC owner account.
Adım Adım Çözüm
Anahtar Kavram
Multi-AZ NAT Gateway routing and cross-account Route 53 Private Hosted Zone association.