AWS Certified Advanced Networking – Specialty (ANS-C01)Network DesignMedium
A company is designing a new cloud-native application that requires isolation between different environments (development, staging, production) within the same AWS account. Each environment will reside in its own VPC. They need a routing strategy that allows controlled communication between these VPCs without exposing them to the public internet, and facilitates shared services access while maintaining security boundaries. Which solution provides the most scalable and manageable inter-VPC connectivity?
- AInternet Gateway with Network ACLs for traffic filtering.
- BAWS Site-to-Site VPN connections between VPCs.
- CAWS Transit Gateway with associated route tables.
- DVPC Peering connections between every pair of VPCs.
Show answer & explanationAnswer & explanation
Correct answer: C. AWS Transit Gateway with associated route tables.
AWS Transit Gateway acts as a central hub, simplifying network architecture by eliminating the need for a mesh of VPC peering connections. It allows for granular control over routing between attached VPCs using associated route tables, providing scalable and manageable inter-VPC connectivity and shared services access while maintaining isolation.
Why the other options are wrong
- A. Internet Gateways provide public internet access and are not suitable for private inter-VPC communication, and Network ACLs alone don't solve the routing complexity across many VPCs.
- B. Site-to-Site VPN is primarily for on-premises connectivity or secure point-to-point connections, not for scalable inter-VPC routing within AWS.
- D. VPC Peering creates a complex mesh network (N*(N-1)/2 connections) that is difficult to manage and scale as the number of VPCs grows, and it does not support transitive routing.
Multi-VPC Connectivity with TGW
Using AWS Transit Gateway to connect multiple VPCs in a hub-and-spoke topology, simplifying routing and network management.
- Eliminates complex VPC peering meshes.
- Enables shared services VPCs.
- Scalable across many VPCs and accounts.
Memory trick: Transit Gateway is the central traffic cop for all your VPCs.