A financial technology organization is designing a hybrid network architecture for its AWS environment. The environment consists of spoke VPCs across multiple AWS accounts in the us-east-1 Region, along with a centralized Shared Services VPC. The organization needs to connect its AWS resources to an on-premises data center.
The connectivity design must meet the following requirements:
1. High-throughput hybrid connectivity must be established using a primary AWS Direct Connect connection, with a Site-to-Site VPN connection acting as a backup.
2. All traffic between the spoke VPCs and the on-premises network must be inspected by a cluster of third-party firewall appliances deployed in the Shared Services VPC.
3. The spoke VPCs must be able to resolve private on-premises domain names using Route 53 with minimal administrative overhead.
4. Egress traffic to the internet must be highly available and centralized through the Shared Services VPC.
5. Administrative overhead must be minimized, and the solution must scale automatically as new spoke VPCs are added.
Which of the following architectures satisfies these requirements?
- Deploy an AWS Transit Gateway (TGW) and attach all spoke VPCs and the Shared Services VPC, enabling Transit Gateway Appliance Mode on the Shared Services VPC attachment. Create a Direct Connect Gateway (DXGW) associated with the TGW via a Transit VIF, and attach the Site-to-Site VPN directly to the TGW. Configure BGP with AS-path prepending on the VPN connection to ensure the Direct Connect path is preferred. Configure TGW route tables to route all spoke-to-on-premises and spoke-to-internet traffic to the Shared Services VPC. In the Shared Services VPC, deploy redundant NAT Gateways across multiple Availability Zones for internet egress. Deploy Route 53 Resolver outbound endpoints in the Shared Services VPC, configure a forwarding rule for the on-premises domain, and share it with all spoke VPCs using AWS Resource Access Manager (RAM).Cevap
- BDeploy an AWS Transit Gateway (TGW) and attach all spoke VPCs and the Shared Services VPC. Associate the DXGW with the TGW. For the backup VPN connection, deploy a virtual private gateway (VGW) in each of the spoke VPCs, establishing VPN tunnels from on-premises to each spoke VPC. Use a single default TGW route table for all VPCs to simplify administration. In the Shared Services VPC, deploy redundant NAT Gateways. Deploy Route 53 Resolver outbound endpoints in the Shared Services VPC and share the forwarding rule with all spoke VPCs using AWS Resource Access Manager (RAM).
- CDeploy an AWS Transit Gateway (TGW) and attach all spoke VPCs and the Shared Services VPC, enabling Transit Gateway Appliance Mode on the Shared Services VPC attachment. Associate the DXGW with the TGW via a Transit VIF, and attach the Site-to-Site VPN directly to the TGW. Configure separate TGW route tables to route all spoke traffic to the Shared Services VPC. Deploy redundant NAT Gateways across multiple Availability Zones in the Shared Services VPC. Create a Route 53 Private Hosted Zone (PHZ) for the on-premises domain and associate it only with the Shared Services VPC, relying on Transit Gateway connectivity for transitive DNS resolution from the spoke VPCs.
- DDeploy an AWS Transit Gateway (TGW) and attach all spoke VPCs and the Shared Services VPC, enabling Transit Gateway Appliance Mode on the Shared Services VPC attachment. Associate the DXGW with the TGW via a Transit VIF, and attach the Site-to-Site VPN directly to the TGW. Configure separate TGW route tables to route all spoke traffic to the Shared Services VPC. Deploy Route 53 Resolver outbound endpoints in the Shared Services VPC, configure a forwarding rule for the on-premises domain, and share it using AWS Resource Access Manager (RAM). To minimize costs, deploy a single NAT Gateway in a public subnet of the Shared Services VPC and configure all route tables across all Availability Zones to route outbound internet traffic through this single NAT Gateway.