Which solution meets these requirements?
Set up a transit gateway in each Region. Establish a redundant AWS Site-to-Site VPN connection between the on-premises firewalls and the transit gateway in the Region that is closest to the on-premises network. Peer all the transit gateways with each other. Connect all the VPCs to the transit gateway in their Region.
Create an AWS CloudFormation template for a redundant AWS Site-to-Site VPN tunnel to the on-premises network. Deploy the CloudFormation template for each VPC. Set up VPC peering between all the VPCs for VPC-to-VPC communication.
Set up a transit gateway in each Region. Establish a redundant AWS Site-to-Site VPN connection between the on-premises firewalls and each transit gateway. Route traffic between the different Regions through the company’s on-premises firewalls. Connect all the VPCs to the transit gateway in their Region.
Create an AWS CloudFormation template for a redundant AWS Site-to-Site VPN tunnel to the on-premises network. Deploy the CloudFormation template for each VPC. Route traffic between the different Regions through the company’s on-premises firewalls.
Explanations:
Setting up a transit gateway in each Region allows for easy management and scaling. By establishing redundant AWS Site-to-Site VPN connections and peering the transit gateways, all VPCs can communicate with each other efficiently across Regions while maintaining high availability. This solution meets the requirement for scalability and inter-VPC communication across all Regions.
This option involves creating a CloudFormation template for a redundant Site-to-Site VPN tunnel for each VPC and establishing VPC peering. While VPC peering can facilitate communication, it does not scale well with the increasing number of VPCs and would require complex management. Each VPC would need to peer with every other VPC, leading to a large number of peer connections.
Although this option suggests using transit gateways, routing all traffic through the on-premises firewalls can create a bottleneck and hinder scalability. It also adds complexity and potential latency in communications, as traffic between Regions must go through on-premises infrastructure rather than allowing for direct communication between VPCs in different Regions via the transit gateways.
Similar to option B, this option relies on CloudFormation for creating Site-to-Site VPNs for each VPC and routing traffic through on-premises firewalls. This not only complicates the architecture but also does not provide a scalable solution for inter-VPC communication, as it relies heavily on on-premises infrastructure instead of leveraging AWS transit gateways effectively.
I gauge that the answer is:
Set up a transit gateway in each Region. Establish a redundant AWS Site-to-Site VPN connection between the on-premises firewalls and the transit gateway in the Region that is closest to the on-premises network. Peer all the transit gateways with each other. Connect all the VPCs to the transit gateway in their Region.