ANS-C01 Question 312
Single answerYour organization is deploying a hybrid cloud architecture and needs to automate the creation of VPN connections between its on-premises data center and multiple AWS environments in different regions. The solution should minimize manual intervention, support dynamic scaling as new AWS regions are added, and ensure secure connectivity. Which approach should you use to achieve this?
- A
Use AWS CloudFormation templates to create VPN connections and configure routing tables in each region.
- B
Leverage AWS Transit Gateway with AWS Site-to-Site VPN and automate the setup using AWS Lambda and the AWS SDK.
- C
Manually configure VPN connections in each region using the AWS Management Console and update configurations as needed.
- D
Use AWS Control Tower to automate the creation of VPN connections across regions and manage routing.
Show answer and explanation
Correct answer: B
Explanation
AWS Transit Gateway enables centralized and scalable connectivity, while Site-to-Site VPN ensures secure connections. Automating the setup using AWS Lambda and the AWS SDK further simplifies management and supports dynamic scaling as new regions are added. This approach meets all the requirements of the scenario effectively.
- A. Incorrect.
CloudFormation templates can automate infrastructure as code, but they are static and would require updates for every new region added. They also do not inherently provide dynamic scaling or centralized management.
- B. Correct.
AWS Transit Gateway with AWS Site-to-Site VPN supports centralized and scalable connectivity. By combining it with AWS Lambda and the AWS SDK, you can automate the creation and management of VPN connections dynamically, ensuring minimal manual intervention and secure connectivity.
- C. Incorrect.
Manual configuration using the AWS Management Console is error-prone, time-consuming, and does not support dynamic scaling or automation, making it unsuitable for this use case.
- D. Incorrect.
AWS Control Tower is primarily designed for governance, account management, and multi-account setup, not for automating or managing VPN connections across regions.