A technology company is designing a new multi-VPC environment in the us-east-1 Region. The architecture consists of a Shared Services VPC and three spoke VPCs (Prod-VPC, Stage-VPC, and Dev-VPC). All spoke VPCs must be able to communicate with the Shared Services VPC, but the spoke VPCs must be completely isolated from one another. Additionally, resources in all spoke VPCs must resolve private DNS records for services hosted in the Shared Services VPC. Which of the following networking designs satisfies these requirements while minimizing administrative overhead?
- ADeploy an AWS Transit Gateway. Attach all VPCs to the Transit Gateway and use the default Transit Gateway route table with automatic propagation enabled for all attachments to allow full mesh routing. Create a Route 53 Private Hosted Zone in the Shared Services VPC, and associate the zone with the Shared Services VPC and all three spoke VPCs.
- BDeploy an AWS Transit Gateway with two Transit Gateway route tables to isolate the spoke VPCs from each other while allowing communication with the Shared Services VPC. Create a Route 53 Private Hosted Zone in the Shared Services VPC, but do not associate it with the spoke VPCs, relying on the default AWS DNS server IP (169.254.169.254) in the spokes to forward queries to the Shared Services VPC automatically.
- Deploy an AWS Transit Gateway with two Transit Gateway route tables. Associate the spoke VPCs with the first route table, routing traffic only to the Shared Services VPC. Associate the Shared Services VPC with the second route table, routing traffic to all spoke VPCs. Create a Route 53 Private Hosted Zone in the Shared Services VPC, and associate the zone with the Shared Services VPC and all three spoke VPCs.Cevap
- DDeploy a single NAT Gateway in a public subnet of the Shared Services VPC. Route all spoke-to-shared traffic through this NAT Gateway, and disable forwarding between spoke subnets. Create a Route 53 Private Hosted Zone in the Shared Services VPC, and associate the zone with all VPCs.
Cevap
Deploy an AWS Transit Gateway with two Transit Gateway route tables. Associate the spoke VPCs with the first route table, routing traffic only to the Shared Services VPC. Associate the Shared Services VPC with the second route table, routing traffic to all spoke VPCs. Create a Route 53 Private Hosted Zone in the Shared Services VPC, and associate the zone with the Shared Services VPC and all three spoke VPCs.
The correct design uses AWS Transit Gateway with two separate route tables to enforce traffic isolation. Spoke VPCs are associated with a route table that only has a route to the Shared Services VPC, preventing them from routing traffic to each other. The Shared Services VPC is associated with a route table that has routes to all spokes, allowing bidirectional communication with them. Furthermore, associating the Route 53 Private Hosted Zone with all four VPCs ensures that private DNS queries from the spoke VPCs can be resolved correctly.
Adım Adım Çözüm
Anahtar Kavram
Multi-VPC isolation using Transit Gateway route tables and DNS resolution using Route 53 Private Hosted Zone associations.
Tahmini Süre:2m 0s