AWS Certified Security – SpecialtyDomain 3: Infrastructure SecurityMedium
A global software company maintains a single AWS account with multiple VPCs across different AWS Regions. They need to establish secure, high-bandwidth network connectivity between these VPCs and also connect to their on-premises data centers via AWS Direct Connect. The security team requires a centralized network routing approach that minimizes management overhead and allows for granular routing control between all connected networks. Which AWS networking service should be used to achieve this?
- AVPC Peering Connections
- BAWS Transit Gateway
- CAWS VPN CloudHub
- DDirect Connect Gateway
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Transit Gateway
AWS Transit Gateway is specifically designed to connect thousands of VPCs and on-premises networks through a central hub. It simplifies network management, offers central routing control, and supports inter-region peering, making it ideal for the complex, global connectivity requirements described.
Why the other options are wrong
- A. VPC Peering Connections are 1:1 connections and do not scale well for a large number of VPCs or provide transitive routing, leading to a complex mesh network.
- C. AWS VPN CloudHub is primarily for connecting multiple on-premises sites to a single VPC using VPNs, not for inter-VPC or inter-region VPC connectivity.
- D. Direct Connect Gateway is used to connect multiple VPCs (in the same or different accounts/regions) to a single Direct Connect connection, but it doesn't provide the centralized routing for VPC-to-VPC or cross-region VPC connectivity that Transit Gateway offers.
AWS Transit Gateway
A network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. It simplifies connectivity by acting as a central hub for all network traffic, eliminating the need for complex mesh networks.
- Connects thousands of VPCs, VPNs, and Direct Connect connections.
- Simplifies network architecture and reduces operational overhead.
- Supports inter-region peering for global connectivity.
- Provides centralized routing control and network isolation.
Memory trick: Transit Gateway is the 'traffic cop' for all your AWS and on-premises networks.