An enterprise is designing a new multi-account network topology in the `ap-southeast-1` region. The architecture includes two spoke VPCs, `vpc-ap-southeast1-frontend` (CIDR ) and `vpc-ap-southeast1-backend` (CIDR ), and a centralized egress VPC, `vpc-ap-southeast1-egress` (CIDR ). An on-premises data center must connect to the VPCs via a 10 Gbps AWS Direct Connect connection. The architecture has the following constraints:
1. Spoke VPCs must not have direct internet access; all outbound internet traffic () must route through the egress VPC, which must be resilient to Availability Zone outages.
2. Spoke VPCs must resolve DNS queries for `corp.internal`, which is a Route 53 Private Hosted Zone managed in a separate Shared Services AWS account.
3. Administrative overhead must be minimized.
Which network architecture meets these requirements while satisfying all constraints?
- ADeploy a Transit Gateway (TGW) and attach `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` to it. In `vpc-ap-southeast1-egress`, deploy redundant NAT Gateways across two Availability Zones. Share the `corp.internal` Private Hosted Zone from the Shared Services account using AWS Resource Access Manager (RAM) to allow automatic cross-account DNS resolution for the spoke VPCs.
- Deploy a Transit Gateway (TGW) and attach `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` to it. In `vpc-ap-southeast1-egress`, deploy redundant NAT Gateways across two Availability Zones in public subnets. Associate the `corp.internal` Private Hosted Zone in the Shared Services account with the spoke and egress VPCs by creating VPC association authorizations in the Shared Services account and accepting them in the spoke and egress accounts.Cevap
- CDeploy a Transit Gateway (TGW) and attach all VPCs to it. In `vpc-ap-southeast1-egress`, deploy a single NAT Gateway in the `ap-southeast-1a` Availability Zone. Configure the private subnet route tables of the spoke VPCs to route outbound internet traffic () to the TGW. Associate the `corp.internal` Private Hosted Zone in the Shared Services account with the spoke and egress VPCs using cross-account VPC association authorizations.
- DDeploy a Direct Connect Gateway (DXGW) connected to the on-premises environment. Attach `vpc-ap-southeast1-frontend`, `vpc-ap-southeast1-backend`, and `vpc-ap-southeast1-egress` directly to the DXGW. Configure Virtual Private Gateways (VGWs) in each VPC, and use the DXGW to route spoke-to-spoke, spoke-to-on-premises, and outbound internet traffic through the NAT Gateways in the egress VPC. Associate the `corp.internal` Private Hosted Zone in the Shared Services account with the spoke and egress VPCs using cross-account VPC association authorizations.