ANS-C01 Question 155
Single answerYour organization has a multi-account AWS setup with a central networking account and multiple application accounts. You need to design a routing strategy to enable connectivity between application VPCs in different AWS Regions while following best practices, maintaining centralized control, and minimizing complexity. Which approach is the most appropriate?
- A
Establish VPC peering connections between all application VPCs across Regions.
- B
Use AWS Transit Gateway in each Region and interconnect them using Transit Gateway peering.
- C
Configure a fully meshed Site-to-Site VPN network between all VPCs in the application accounts.
- D
Deploy a NAT Gateway in each VPC and route the traffic through the Internet Gateway for inter-VPC communication.
Show answer and explanation
Correct answer: B
Explanation
For a multi-account, multi-region architecture with multiple VPCs, AWS Transit Gateway is the recommended solution. It allows centralized routing, simplifies management, and can scale to accommodate large numbers of VPCs. Transit Gateway peering across Regions enables efficient and secure communication while adhering to AWS best practices. Other options either fail to meet scalability or security requirements or introduce unnecessary complexity.
- A. Incorrect.
VPC peering can connect VPCs, but it becomes complex and unmanageable in a multi-account, multi-region architecture as the number of VPCs grows. It also lacks centralized routing and scaling capabilities.
- B. Correct.
Using AWS Transit Gateway in each Region and interconnecting them with Transit Gateway peering is the best practice for multi-account, multi-region architectures. It centralizes routing, scales well, and simplifies management.
- C. Incorrect.
A fully meshed Site-to-Site VPN network is operationally complex, less scalable, and not cost-effective for connecting multiple VPCs in a multi-region setup.
- D. Incorrect.
Using NAT Gateways and Internet Gateways for inter-VPC communication is not recommended as it involves unnecessary routing through the public Internet, leading to increased latency, cost, and security risks.