AWS Certified Advanced Networking – Specialty (ANS-C01)Network DesignHard
A large organization uses multiple AWS accounts and VPCs across several regions. They need to implement a centralized egress strategy where all outbound internet traffic from development and test VPCs passes through a dedicated set of security appliances in a 'security VPC' in the primary region. This setup must also support IPv6 traffic. Which architecture pattern should they implement?
- AAWS Client VPN endpoints configured in the security VPC
- BDistributed Internet Gateways in each development VPC with security groups
- CVPC Peering with NAT Gateways in each development VPC
- DAWS Transit Gateway with a centralized Egress VPC and IPv6 routing
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Transit Gateway with a centralized Egress VPC and IPv6 routing
Transit Gateway provides the central hub to connect all development and test VPCs to the security VPC. Routing rules on the Transit Gateway can then direct all outbound traffic through the security appliances. Transit Gateway also inherently supports IPv6 routing, allowing for a consolidated egress point for both IPv4 and IPv6 traffic.
Why the other options are wrong
- A. Client VPN is for remote access and does not facilitate centralized egress for VPCs and would not handle IPv6 traffic from within VPCs.
- B. Distributed Internet Gateways would mean decentralized egress, bypassing the security VPC, and managing security groups across many VPCs is complex.
- C. VPC Peering does not centralize egress or allow for transitive routing through a security VPC, and NAT Gateways are for IPv4 only, not IPv6.
Centralized Egress with TGW (IPv6)
An architecture pattern using AWS Transit Gateway to route all outbound internet traffic from multiple VPCs through a single security VPC, supporting both IPv4 and IPv6.
- Enforces security policies uniformly across multiple VPCs.
- Simplifies network management and auditing.
- Leverages Transit Gateway for scalable and centralized routing.
Memory trick: All internet traffic transits through one security gateway, even for IPv6.