A company has a single AWS Direct Connect connection from its data center to a Direct Connect location, and separate VPCs in two different AWS Regions that it wants that same connection to reach, each VPC keeping its own virtual private gateway. What AWS resource is designed to let one Direct Connect connection reach VPCs across multiple Regions like this?
- A second Direct Connect connection provisioned in the second Region, since a single Direct Connect connection can only ever reach VPCs in the Region it physically terminates in
- A Transit Gateway peering attachment between the two Regions' Transit Gateways, with no involvement from Direct Connect needed once the peering is active
- A VPC peering connection between the two Regions' VPCs, layered on top of the existing Direct Connect connection
- A Direct Connect gateway, a globally available resource that can be associated with virtual private gateways (or Transit Gateways) in multiple Regions, letting one Direct Connect connection reach VPCs across those Regions
Why D? And why not the others?
Correct answer: D. A Direct Connect gateway, a globally available resource that can be associated with virtual private gateways (or Transit Gateways) in multiple Regions, letting one Direct Connect connection reach VPCs across those Regions
A Direct Connect gateway is a globally available resource, acting as a distributed set of BGP route reflectors, that can be associated with virtual private gateways (or Transit Gateways) belonging to VPCs in different Regions; this lets a single Direct Connect connection, via one private or transit virtual interface into the Direct Connect gateway, reach VPCs across multiple Regions instead of being confined to the Region where the connection physically terminates. The 'second Direct Connect connection' option is wrong because it describes exactly the costly, connection-per-Region approach that a Direct Connect gateway is designed to eliminate. The 'Transit Gateway peering with no Direct Connect involvement' option is wrong because Transit Gateway peering only connects Transit Gateways to each other; it does nothing to extend an on-premises Direct Connect connection's reach into a second Region's VPCs without a Direct Connect gateway (or a separate Direct Connect connection) in the picture. The 'VPC peering on top of Direct Connect' option is wrong because VPC peering connects VPCs to each other directly and has no role in extending an on-premises Direct Connect connection to a Region it doesn't already terminate in.
Source: AWS Direct Connect User Guide: Direct Connect gateways — 'A Direct Connect gateway is a globally available resource... enables you to use your Direct Connect connection... to access VPCs in your account in both [Region]... and [Region]...'