Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A logistics company is setting up a new multi-account AWS environment with 55 VPCs in the `us-east-1` Region. These VPCs belong to different AWS accounts managed under a single AWS Organization. The company needs to establish any-to-any network connectivity among all 55 VPCs and connect them to their on-premises corporate headquarters via an AWS Direct Connect connection. Additionally, a central Route 53 Private Hosted Zone (PHZ) must be resolvable from all VPCs, and all outbound internet traffic must be routed through a centralized egress VPC containing NAT Gateways. The solution must scale with minimal administrative overhead and avoid any single point of failure. Which network architecture should a solutions architect recommend to meet these requirements?

  1. Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all 55 spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy redundant NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route table to route all outbound internet traffic (0.0.0.0/00.0.0.0/0) to the egress VPC. Associate the Private Hosted Zone with all VPCs.Cevap
  2. B
    Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all 55 spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy redundant NAT Gateways across multiple Availability Zones. Associate the Private Hosted Zone only with the egress VPC and rely on Transit Gateway to route DNS queries from other VPCs.
  3. C
    Create a Direct Connect Gateway and associate it directly with the Virtual Private Gateways in all VPCs using private virtual interfaces. Establish a full mesh of VPC peering connections among all 55 VPCs for inter-VPC traffic. Deploy NAT Gateways in each spoke VPC for internet egress, and associate the Private Hosted Zone with all VPCs.
  4. D
    Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all 55 spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy a single NAT Gateway in one Availability Zone to centralize all outbound internet traffic, and associate the Private Hosted Zone with all VPCs.

Cevap

Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. Deploy redundant NAT Gateways in the egress VPC across multiple Availability Zones, and configure routing to point outbound traffic to the egress VPC. Associate the Route 53 Private Hosted Zone with all VPCs to ensure DNS resolution.
The correct architecture uses AWS Transit Gateway shared via AWS Resource Access Manager (RAM) to act as a centralized hub, providing scalable any-to-any connectivity with minimal routing complexity. Associating the Direct Connect Gateway with Transit Gateway requires a transit virtual interface (Transit VIF), which supports transitive routing to multiple VPCs. Deploying redundant NAT Gateways across multiple Availability Zones in the egress VPC ensures high availability for outbound traffic, and associating the Private Hosted Zone directly with all VPCs ensures successful DNS resolution across accounts.

Adım Adım Çözüm

1
Centralize transit routing using AWS Transit Gateway.
A central Transit Gateway is deployed in a network account and shared with the AWS Organization using AWS Resource Access Manager (RAM).
This avoids the administrative complexity of full-mesh VPC peering and scales dynamically as new VPCs are added.
2
Connect the on-premises environment using AWS Direct Connect.
The Direct Connect Gateway is associated with the central Transit Gateway using a transit virtual interface (Transit VIF).
Transit VIF is required to enable transitive hybrid routing between the on-premises network and multiple VPCs via Transit Gateway.
3
Configure high availability for central internet egress.
An egress VPC is attached to the Transit Gateway, containing NAT Gateways deployed across multiple Availability Zones.
Routing outbound traffic (0.0.0.0/00.0.0.0/0) to redundant NAT Gateways avoids a single point of failure and ensures egress resilience.
4
Configure Route 53 Private Hosted Zone (PHZ) association.
The central PHZ is associated with all VPCs across the accounts.
DNS resolution for a PHZ requires explicit association with each consumer VPC, as Transit Gateway does not propagate DNS queries implicitly.

Anahtar Kavram

AWS Transit Gateway offers a hub-and-spoke architecture that simplifies multi-VPC and hybrid network routing. Direct Connect Gateway associated with a Transit Gateway requires a transit virtual interface (Transit VIF) to support multi-account transitive routing. Outbound internet egress can be centralized through an egress VPC containing redundant NAT Gateways in multiple Availability Zones to ensure high availability. Route 53 Private Hosted Zones (PHZs) must be explicitly associated with each VPC in the organization to allow DNS resolution across all accounts.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru