AWS site-to-site VPN doesn't support transitive networking

[tim-armstrong]

Hi.

For the flowing question from practice exam, I did not think that the correct answer provided would allow for transitive communication between the VPCs, which appears to be a requirement from the question, “These applications must be able to connect to the on-premises data center as well to each other.” What am I missing or failing to interpret correctly? How does an AWS Site-To-Site VPN meet the transitive VPC requirements of the question? What does the complete solution look like?

EXAM QUESTION: A company has hundreds of applications deployed in three different Amazon VPCs. These applications must be able to connect to the on-premises data center as well to each other. The connection must have an AES256 encryption and be authenticated with SHA1 or SHA2 hashing functions. It should also use Diffie-Hellman (DH) groups for key exchange to support Perfect Forward Secrecy (PFS). The solution should automatically rotate the certificate for the AWS-side of the tunnel endpoint using a service-linked role.

What are the steps required in order to properly set up this network architecture?

<b style=”font-family: inherit; font-size: inherit;”>CORRECT ANSWER: Set up an AWS VPN connection.

[tim-armstrong]

I think i understand now, but want to confirm. The solution would be a complete full mesh AWS site-to-site VPN, where each VPC would have connectivity to each other VPC and the on-prem data center. That would meet the requirements of the question, meeting the VPN options requirements and allowing the applications to connect to each other and the on-prem data center. Let me know if i am now on the right track.

[Carlo-TutorialsDojo]

Hello tim,

Thank you for your insights.

Not necessarily a mesh. Although that is the old of doing it, you can instead use the AWS Transit Gateway to interconnect VPCs and on-premises network in a central hub. This is much simpler than setting up many complex peering networks.

Let me know if you need more clarifications.

Regards,

Carlo @ Tutorials Dojo