Question

A company operates 40 VPCs spread across three AWS accounts in the eu-west-1 Region. They connect to two on-premises data centers using Direct Connect. Requirements: (1) all VPCs must reach on-premises networks over Direct Connect, (2) each VPC's CIDR must be advertised to on-premises, and (3) the design must scale to 100+ VPCs while minimizing per-connection management overhead. They currently use one Direct Connect gateway associated directly with each VPC's virtual private gateway. As they grow, they hit the limit on the number of VGWs that can be associated with a single Direct Connect gateway. Which design change best meets the requirements at scale?

Accepted Answer

Deploy a single Transit Gateway shared across accounts via AWS RAM, attach all VPCs to it, and create a Direct Connect gateway association with that Transit Gateway.

Answer

Deploy a Transit Gateway in each account, associate each Transit Gateway with the Direct Connect gateway, and attach the VPCs to their local Transit Gateway.

Answer

Create additional Direct Connect gateways and distribute the VGW associations across them so no single gateway exceeds its VGW association limit.

Answer

Replace Direct Connect with multiple Site-to-Site VPN connections terminated on each VPC's virtual private gateway to avoid Direct Connect gateway limits.