Exam-style
An Adelaide bulk-rail freight operator runs 30 VPCs across 22 accounts, 18 in ap-southeast-2 and 12 in ap-southeast-4, plus a 10 Gbps Direct Connect link to a signalling data centre. Every VPC must reach every other and the data centre, except that the 11 non-production VPCs must not reach the 19 production ones. What should they build?
Reveal the answer
D. A transit gateway per Region, peered together, separate association route tables for production and non-production, and one Direct Connect gateway associated to both over a transit virtual interface
A transit gateway takes one attachment per VPC against a default quota of 5,000 attachments. Each attachment associates with exactly one transit gateway route table, so a production table and a non-production table carry the separation, and the 31st VPC changes nothing in the other 30. One Direct Connect gateway associates with both transit gateways over a transit virtual interface, inside the fixed limit of 6 per Direct Connect gateway, and its attachment takes a third table that both environments propagate into. The trimmed mesh is 226 connections, 171 among the 19 production VPCs and 55 among the 11 non-production, each needing routes at both ends. No VPC there exceeds 18 peerings, inside the default 50 per VPC. Edge-to-edge routing is unsupported, so a VPC cannot use a Direct Connect connection that reaches its peer, and each needs its own virtual private gateway association, capped at a fixed 20 per Direct Connect gateway. Routing instances become the bottleneck. PrivateLink publishes one service rather than routing between address ranges, and a public virtual interface reaches AWS public endpoints, not a VPC. A Cloud WAN core network is assembled from attachments, whose core network edges full-mesh peer automatically.
Q. Thirty VPCs over two Regions, a Direct Connect link to a data centre, non-production kept out of production. Mesh or transit gateway?
A. A transit gateway in each Region, peered together. Every VPC attaches once, against a default quota of 5,000 attachments. Each attachment associates with exactly one route table, so a production table and a non-production table carry the separation, and the 31st VPC changes nothing in the other 30. One Direct Connect gateway associates with both over a transit virtual interface, its attachment taking a third table both environments propagate into.
Why? The mesh does not fail on the count. Dropping the forbidden pairs trims 435 connections to 226, no VPC needing more than 18, inside the default 50. It fails on the on-premises leg. Edge-to-edge routing is unsupported, so a VPC cannot use a Direct Connect connection that reaches its peer: each needs its own virtual private gateway association, capped at 20 per Direct Connect gateway.
Peering attachments carry static routes only, no ECMP, so each side needs a static route for the other Region’s ranges. One attachment exists per pair, so both environments cross it. Summarise each into a supernet and blackhole the other.