AWS network questions

Hi Olive,

As I understand correctly, VPC "abc" is only in Singapore region and VPC with name "XYZ" is in both Singapore and Hong Kong region

Assuming A & B are Transit gateways (TGWs) in the given diagram -

1. TGW A is it able to terminate the vpn attachment as shown - to abc and xyz?

Answer: Please be advised that TGW is a regional entity. Let's say you have TGW A (in Singapore region). You can terminate your VPN connection on TGW A (Singapore region) and have VPC "XYZ" (in Singapore region) and VPC "ABC" (in Singapore region) as TGW attachments for the communication to happen between on-prem and AWS VPC's in Singapore region. In order to connect to Hong Kong region, you would need a different TGW as it is a regional entity.

2. TGW at abc and xyz, this 2 TGW need peering in between?

Answer:

• If you have VPC "XYZ" and TGW B in Hong Kong region & VPC "abc" and TGW A in Singapore region, you would need TGW peering connection between them.

• If you would like to have communication from on-prem to Hong Kong region and there is no VPN connection terminating on Hong Kong TGW B, here is the traffic flow

  on-prem --- VPN Connection --- TGW A (Singapore region) --- TGW peering --- TGW B (Hong Kong region)

3. For C and D, region SG to have AZ/SG and region HK to have AZ/HK as HA setup, Is it feasible? Does it need peering connection?

Answer: If I reiterate correctly, I believe you are asking for HA setup in case of region failure. You can make use of Direct connect gateway which is a global entity and have your TGW A (Singapore region) and TGW B (Hong Kong region) associated to it and have Direct connect with transit VIF built. You can achieve high availability if Singapore region goes down, then the traffic will be shifted to Hong Kong region. You can do peering connection here like

on-prem --- DX connection --- TGW A (Singapore region) --- TGW peering --- TGW B (Hong Kong region).

In the above flow - If Singapore region goes down, there is no way to connect directky to Hong Kong region. So, the best practice is

on-prem --- DX connection --- DX Gateway --- Associate TGW A (Singapore region) & TGW B (Hong Kong region)

4. For E, is it feasible to do endpoint private link from different region? As HA setup

Answer: Yes, it is feasible to have private link from different region with high available architecture. Kindly refer to the link [1] for design and more information on this.

Kindly refer to these architectures [2] [3] as well which might help you. I hope this answers your questions. Thank you.

References:

[1] https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html#inter-region-endpoint-services

[2] https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-peering-scenario.html

[3] https://d1.awsstatic.com/architecture-diagrams/ArchitectureDiagrams/hybrid-connectivity-to-transit-gateway-ra.pdf?ntwd_hyb5