Which network configuration should a solutions architect use to provide connectivity from the client applications in the business unit VPCs to the centralized application in the shared VPC?
Create an AWS Transit Gateway. Attach the shared VPC and the authorized business unit VPCs to the transit gateway. Create a single transit gateway route table and associate it with all of the attached VPCs. Allow automatic propagation of routes from the attachments into the route table. Configure VPC routing tables to send traffic to the transit gateway.
Create a VPC endpoint service using the centralized application NLB and enable the option to require endpoint acceptance. Create a VPC endpoint in each of the business unit VPCs using the service name of the endpoint service. Accept authorized endpoint requests from the endpoint service console.
Create a VPC peering connection from each business unit VPC to the shared VPAccept the VPC peering connections from the shared VPC console. Configure VPC routing tables to send traffic to the VPC peering connection.
Configure a virtual private gateway for the shared VPC and create customer gateways for each of the authorized business unit VPCs. Establish a Site-to-Site VPN connection from the business unit VPCs to the shared VPC. Configure VPC routing tables to send traffic to the VPN connection.
Explanations:
AWS Transit Gateway does not support overlapping CIDR ranges across VPCs, making it unsuitable for this scenario, as some business unit VPC CIDR blocks overlap with each other and the shared VPC.
A VPC endpoint service with an NLB provides a scalable and secure way to connect multiple VPCs, including those with overlapping CIDR ranges. Each business unit VPC can connect to the centralized application without IP conflicts, and access can be controlled by accepting endpoint connection requests.
VPC peering does not support overlapping CIDR ranges between VPCs, so this option is unsuitable as some business unit VPCs have overlapping IP ranges with each other and with the shared VPC.
Site-to-Site VPN connections are typically used for connecting on-premises networks to AWS and are not ideal for connecting multiple VPCs within AWS. This method also does not handle overlapping CIDR ranges efficiently.