Architecture Design and Implementation Built for the Cloud · Topic 7 of 11
Hybrid Connectivity, Hybrid DNS and Multi-VPC Design
Build resilient Direct Connect and VPN links with Transit Gateway, resolve hybrid DNS with Route 53 Resolver, and connect VPCs with peering or PrivateLink.
- 5 min
- Includes a diagram
- Maximum resilience means Direct Connect at two locations with redundant connections; VPN is the cost-effective backup.
- Direct Connect gateway plus transit VIF connects Direct Connect to Transit Gateways in many Regions.
- Peering is not transitive and needs non-overlapping CIDRs; Transit Gateway is the scalable hub.
What it is
Large AWS estates have many VPCs across many accounts, plus one or more data centers. Hybrid connectivity joins the data centers to AWS, multi-VPC design joins the VPCs to each other, and hybrid DNS makes names resolve correctly in both directions.
The exam judges these designs on redundancy, the number of connections to manage, and whether IP ranges overlap.
How it works
Redundant hybrid connectivity
| Option | Strength | Limitation |
|---|---|---|
| AWS Direct Connect | Private, consistent bandwidth and latency | Takes time to provision; one connection is a single point of failure |
| AWS Site-to-Site VPN | Quick to set up, encrypted over the internet | Internet-dependent performance |
| Direct Connect plus VPN backup | Cost-effective resilience | Backup path has lower, variable performance |
| Direct Connect at two locations, two connections each | Maximum resilience for critical workloads | Highest cost |
Each VPN connection has two tunnels, and BGP chooses between paths. When VPN backs up Direct Connect, BGP prefers the Direct Connect route and fails over to the VPN automatically.
A Direct Connect gateway lets one Direct Connect connection reach VPCs in many Regions. A transit virtual interface connects the Direct Connect gateway to Transit Gateways, which then reach every attached VPC.
Direct Connect is not encrypted by default. Use MACsec on supported dedicated connections, or run a Site-to-Site VPN over the Direct Connect link when the requirement is encryption in transit.
Transit Gateway supports ECMP across multiple VPN tunnels, which increases aggregate VPN bandwidth.
Multi-VPC connectivity
| Option | Best for | Key constraints |
|---|---|---|
| VPC peering | A few VPCs, lowest latency, no per-hour gateway | Not transitive, no overlapping CIDRs, full-mesh does not scale |
| Transit Gateway | Hub for hundreds of VPCs and hybrid links | Route tables provide segmentation; data processing charges apply |
| AWS PrivateLink | Exposing one service to many consumers | One direction only, consumer to provider; overlapping CIDRs allowed |
| AWS Cloud WAN | Global network across Regions with central policy | More suited to large global estates |
Share a Transit Gateway with other accounts through AWS RAM. PrivateLink places an interface endpoint in the consumer VPC and an NLB-fronted endpoint service in the provider VPC, so consumers never see the provider network.
Hybrid DNS with Route 53 Resolver
- An inbound endpoint gives on-premises DNS servers IP addresses in the VPC to forward queries for AWS private hosted zones.
- An outbound endpoint with forwarding rules sends queries for on-premises domains, such as corp.example.com, to on-premises DNS servers. This is conditional forwarding.
- Share Resolver rules with other accounts through AWS RAM, and associate them with their VPCs, so one set of endpoints serves the organization.
- Private hosted zones answer only inside associated VPCs, and can be associated with VPCs in other accounts.
- Split-horizon DNS uses a public and a private hosted zone with the same name, so internal clients get private addresses and internet clients get public ones.
How the exam asks about this
- "A single Direct Connect link failed and caused an outage; the fix must be cost-effective" -> add a Site-to-Site VPN as a BGP backup path to the Transit Gateway.
- "A SaaS team must expose an API to hundreds of customer VPCs with overlapping CIDRs" -> AWS PrivateLink endpoint service behind an NLB.
- "EC2 instances must resolve on-premises names, and on-premises servers must resolve private hosted zones" -> Route 53 Resolver outbound endpoint with forwarding rules, plus an inbound endpoint.
What to remember for the exam
- Maximum resilience means Direct Connect at two locations with redundant connections; VPN is the cost-effective backup.
- Direct Connect gateway plus transit VIF connects Direct Connect to Transit Gateways in many Regions.
- Peering is not transitive and needs non-overlapping CIDRs; Transit Gateway is the scalable hub.
- PrivateLink is one-way service exposure and tolerates overlapping CIDRs.
- Inbound endpoints answer on-premises queries; outbound endpoints with rules forward AWS queries to on premises.
- Share Transit Gateways and Resolver rules across accounts with AWS RAM.
Direct Connect does not encrypt traffic by default. If a scenario requires encryption over Direct Connect, the answer is MACsec where supported or an IPsec VPN over the connection, not Direct Connect alone.
Common mistakes
Expecting transitive routing through peering. VPC A peered with B and B with C does not let A reach C. Use Transit Gateway when many VPCs must talk.
Running Resolver endpoints in every account. Central endpoints in a shared networking account, with rules shared through RAM, cost less and are easier to manage.
Treating two virtual interfaces on one connection as redundancy. Both depend on the same physical connection and location. Redundancy needs separate connections, ideally at separate Direct Connect locations.
Check yourself
Which Route 53 Resolver component lets on-premises servers resolve a private hosted zone?
An inbound endpoint, which gives on-premises DNS servers VPC IP addresses to forward those queries to.
Why choose PrivateLink over Transit Gateway for a shared service?
PrivateLink exposes only the service, in one direction, and works when consumer and provider CIDRs overlap.
What is the cost-effective way to add failover to a single Direct Connect connection?
Add a Site-to-Site VPN as a backup path, and let BGP prefer Direct Connect and fail over to the VPN.
Topic 7 of 11 in Architecture Design and Implementation Built for the Cloud
Test yourself on Architecture Design and Implementation Built for the Cloud
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.