- Newest
- Most votes
- Most comments
You need two different VIF types
Transit VIF → to reach the transit gateway in us-east-1(so multiple VPCs there can access on-prem resources). Private VIF → to reach the single VPC in eu-west-1 (to one on-prem server per policy).
A Direct Connect gateway (DXGW) can be associated either with a transit gateway or with one/more virtual private gateways (VGWs),not both. So you must use two DXGWs:
DXGW #1 associated with the TGW(for the transit VIF to us-east-1) DXGW #2 associated with the VGW(for the private VIF to the eu-west-1 VPC)
To design a hybrid architecture connecting your on-premises data center to multiple VPCs across two AWS Regions (us-east-1 and eu-west-1), I recommend using AWS Direct Connect with Direct Connect Gateway.
Here's how you can implement this architecture:
-
Set up AWS Direct Connect connections from your on-premises data center to AWS. For high resiliency, consider establishing connections at multiple AWS Direct Connect locations with dynamic routing.
-
Create a Direct Connect Gateway, which will allow you to establish connectivity between your Direct Connect connection and VPCs in different AWS Regions.
-
For us-east-1 Region (where all VPCs need access to on-premises):
- Deploy an AWS Transit Gateway to consolidate connectivity for all VPCs in this region
- Attach all your VPCs in us-east-1 to this Transit Gateway
- Associate the Transit Gateway with your Direct Connect Gateway
- Configure appropriate route tables in the Transit Gateway to allow traffic between the VPCs and your on-premises network
- For eu-west-1 Region (where only one VPC needs access):
- You have two options: a) Create a Virtual Private Gateway (VGW) for the specific VPC that needs on-premises access, and associate this VGW with your Direct Connect Gateway b) Alternatively, deploy a Transit Gateway in eu-west-1, attach only the specific VPC that needs on-premises access, and associate this Transit Gateway with your Direct Connect Gateway
-
Configure route tables in all VPCs and your on-premises network to ensure proper routing of traffic.
-
For additional resiliency, consider implementing AWS Site-to-Site VPN as a backup for your Direct Connect connections, terminating on your Transit Gateways.
This architecture provides the selective connectivity you need while maintaining scalability. The edge consolidation approach using Transit Gateway in us-east-1 makes it easy to manage connectivity for multiple VPCs, while the more targeted approach in eu-west-1 ensures only the specified VPC has access to on-premises resources.
Sources
Hybrid connectivity - Building a Scalable and Secure Multi-VPC AWS Network Infrastructure
AWS Direct Connect | Create resilient hybrid networks | AWS
Architecture selected by Example Corp. Automotive - Hybrid Connectivity
Enable communication from VPC A to on-premise through VPC B | AWS re:Post
answered a year ago
