How to Connect Multiple VPCs Across Accounts to On-Premises with High Availability?

ANS-C01 By islever Editorial Last updated

Short answer

A Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.

Question

A company hosts infrastructure services in multiple VPCs across multiple accounts in the us-west-2 Region. The VPC CIDR blocks do not overlap. The company wants to connect the VPCs to its data centers by using AWS Site-to-Site VPN tunnels. The connections must be encrypted in transit. Additionally, the connection from each data center must route to the closest AWS edge location. The connections must be highly available and must accommodate automatic failover. Which solution will meet these requirements?
  1. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering. Correct Answer
  2. Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.
  3. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure static routing.
  4. Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure static routing.

Key Takeaways

The key requirements are multi-account connectivity, VPN acceleration, and automatic failover — which mandates BGP dynamic routing over static routing and a Transit Gateway over standalone Virtual Private Gateways.

This question tests the architecture for connecting multiple VPCs across AWS accounts to on-premises data centers using AWS Transit Gateway, Site-to-Site VPN with acceleration, and BGP dynamic routing for automatic failover. Community consensus strongly supports Option A.

Common mistake: Candidates often choose Option C, which is nearly identical to A but uses static routing instead of BGP. Static routing does not support automatic failover as effectively as BGP, which dynamically detects tunnel failures and reroutes traffic.

Expert Analysis

This question requires you to satisfy several requirements simultaneously: multi-account VPC connectivity, encrypted Site-to-Site VPN, routing to the closest AWS edge location, high availability, and automatic failover.

Why Option A is Correct

Option A uses a Transit Gateway (TGW) shared across accounts via AWS Resource Access Manager (RAM), which is the AWS best practice for hub-and-spoke multi-account networking. Each service account creates a VPC attachment to the TGW. The TGW then serves as the central point for Site-to-Site VPN tunnel attachments.

Critically, Option A enables VPN acceleration, which uses AWS Global Accelerator edge locations to route traffic to the closest AWS point of presence, satisfying the "closest edge location" requirement. It also configures BGP dynamic routing, which provides automatic failover — when one tunnel goes down, BGP converges and traffic seamlessly shifts to the remaining tunnel.

Why Option C is Wrong

Option C is almost identical to A but uses static routing instead of BGP. While static routing can work with VPN, it does not provide the same level of automatic failover capability. BGP continuously monitors tunnel health and dynamically adjusts routes, making it the correct choice for the high availability and automatic failover requirement.

Why Options B and D are Wrong

Options B and D deploy Virtual Private Gateways (VGW) in each account instead of using a Transit Gateway. This approach does not scale well for multi-account architectures and makes centralized management difficult. Additionally, VPN acceleration is not supported on standalone Virtual Private Gateways — it is only available when the VPN is attached to a Transit Gateway. This immediately disqualifies both B and D.

Community Consensus

As noted by community members, the combination of BGP for automatic failover and Transit Gateway for acceleration support clearly points to Option A. The distinction between A and C comes down entirely to dynamic vs. static routing.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see 'automatic failover' combined with AWS VPN, always look for BGP dynamic routing. Also remember that VPN acceleration is only available on Transit Gateway attachments, not on standalone Virtual Private Gateways — this is a common trap in AWS networking questions.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Blitz1 👍 3 Answered A
    automatic failover = BGP -> so we exclude static acceleration is not possible in Virtual private gateway -> and this is how we remain with (A)
  2. KobDragoon 👍 3 Answered A
    Looks good, A over C just due to dynamic routing with BGP peering instead of static routing.
  3. Kayceetalks 👍 3
    A - correct
  4. psou7 👍 1
    I agree with A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide