Which set of additional steps should the solutions architect take to meet these requirements?

By:
In: SAP-C02
Tagged:
With: 2 Comments
A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts.Each VPC consists of public subnets and private subnets that span across multiple Availability Zones.NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.A solutions architect is working on a hub-and-spoke design.All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC.The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.

Which set of additional steps should the solutions architect take to meet these requirements?

Create peering connections between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.

Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.

Create a transit gateway in every account. Attach the NAT gateway to the transit gateways. Configure the required routing to allow access to the internet.

Create an AWS PrivateLink connection between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.

Explanations:

While creating peering connections can establish direct communication between the egress VPC and spoke VPCs, it does not scale well for managing hundreds of accounts and VPCs. Additionally, peering does not provide the centralized management and routing capabilities necessary for efficient internet egress.

A transit gateway simplifies network architecture by allowing multiple VPCs to connect to a central point. It provides scalable connectivity between the egress VPC and spoke VPCs and facilitates the required routing for outbound internet access through the NAT gateway in the egress VPC. Sharing the transit gateway across accounts enhances manageability and connectivity.

Creating a transit gateway in every account complicates the architecture and management. Each transit gateway would require individual management, and attaching NAT gateways to each one is redundant and inefficient. This does not meet the requirement of a centralized egress point for internet access.

AWS PrivateLink is designed for providing private connectivity to services over the AWS network, but it does not facilitate outbound internet access. This option does not allow the spoke VPCs to route traffic to the internet through the NAT gateway in the egress VPC, making it unsuitable for the requirements.

2026-03-28

2 Comments

  1. Charlotte
    Author

    In my experience, the answer is:
    Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.

  2. Michelle
    Author

    Based on what I know, the answer is:
    Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.

Leave a Reply

Your email address will not be published. Required fields are marked *

13 − twelve =