SAP-C02 Question 6
Select 2Your company operates a multi-account architecture in AWS with a centralized networking account used for routing and connectivity. You are tasked with designing a solution to allow secure and scalable communication between application workloads running in multiple VPCs across different AWS accounts. The solution must minimize the complexity of managing routes and support potential future growth in the number of VPCs. Which of the following strategies should you implement?
- A
Use AWS Transit Gateway in the networking account to establish inter-VPC connectivity and share it across accounts using Resource Access Manager (RAM).
- B
Set up VPC Peering between all VPCs across accounts to achieve direct connectivity.
- C
Deploy a centralized AWS PrivateLink endpoint in the networking account, and connect all VPCs to this endpoint for communication.
- D
Use AWS Direct Connect Gateway to connect all VPCs across accounts.
- E
Implement a hub-and-spoke architecture with an AWS Transit Gateway in the networking account for centralized connectivity.
Show answer and explanation
Correct answers: A, E
Explanation
AWS Transit Gateway is the recommended solution for establishing scalable and centralized connectivity between multiple VPCs across accounts. It allows you to manage connectivity in a hub-and-spoke architecture, which simplifies route management and supports the integration of additional VPCs as the network grows. Resource Access Manager (RAM) enables sharing the Transit Gateway with other accounts, further reducing complexity. VPC Peering and AWS PrivateLink are less scalable options for this use case, while AWS Direct Connect Gateway is not relevant for inter-VPC connectivity.
- A. Correct.
This is correct. AWS Transit Gateway provides scalable and centralized connectivity for multiple VPCs across accounts. Using AWS Resource Access Manager (RAM), you can share the Transit Gateway with other accounts, reducing complexity in route management.
- B. Incorrect.
This is incorrect. VPC Peering requires explicit creation and management of peering connections between each pair of VPCs, which becomes impractical and unscalable as the number of VPCs grows.
- C. Incorrect.
This is incorrect. AWS PrivateLink is designed for exposing specific services or applications across VPCs, not for general-purpose network connectivity between VPCs.
- D. Incorrect.
This is incorrect. AWS Direct Connect Gateway is used to connect an on-premises network to multiple VPCs, not for inter-VPC connectivity within AWS.
- E. Correct.
This is correct. A hub-and-spoke architecture with AWS Transit Gateway simplifies network management by centralizing connectivity, improves scalability, and supports future growth in the number of VPCs.