AWS Certified Advanced Networking – Specialty (ANS-C01)Network DesignMedium
A large corporation uses AWS Organizations to manage hundreds of accounts. They need to establish secure and private connectivity between their on-premises data centers and multiple VPCs spread across different accounts and Regions. The solution must provide a single point of entry and exit for all on-premises traffic to AWS, simplify network management, and support dynamic routing. Which networking construct should be implemented?
- AMultiple AWS Site-to-Site VPN connections to each VPC
- BAWS PrivateLink endpoints in each VPC
- CAWS Direct Connect Gateway with AWS Transit Gateway
- DVPC Peering connections between all VPCs and a central VPN VPC
Show answer & explanationAnswer & explanation
Correct answer: C. AWS Direct Connect Gateway with AWS Transit Gateway
AWS Direct Connect Gateway provides connectivity between Direct Connect connections and multiple VPCs across different AWS Regions and accounts. When combined with AWS Transit Gateway, it provides a centralized hub for all on-premises to AWS traffic, simplifying routing and management while supporting dynamic routing protocols like BGP.
Why the other options are wrong
- A. Multiple VPNs to each VPC would be complex and unscalable for hundreds of VPCs.
- B. PrivateLink provides private connectivity to specific services, not general on-premises to multi-VPC connectivity.
- D. VPC Peering is a many-to-many connection, but doesn't provide a centralized on-premises entry point or scale well for hundreds of VPCs/accounts.
Direct Connect Gateway with Transit Gateway
A combination of AWS services for centralized, private, and scalable connectivity between on-premises networks and multiple VPCs across AWS accounts and Regions.
- Centralized on-premises connectivity
- Supports multiple VPCs across accounts/Regions
- Simplifies routing and management
- Allows dynamic routing protocols (BGP)
Memory trick: Direct Connect Gateway + Transit Gateway: The ultimate hybrid network bridge.