A company has established connectivity between its on-premises data center in Paris, France, and the AWS Cloud by using an AWS Direct Connect…

This solution provides a scalable and timely architecture. A Transit Gateway (TGW) in the Tokyo Region creates a regional network hub, similar to the existing Paris setup. Peering the Tokyo TGW with the Paris TGW enables secure, private, and high-bandwidth connectivity between the two AWS regions over the AWS global backbone. For connecting the on-premises Tokyo office, an AWS Site-to-Site VPN is the most appropriate choice given the 5-day deadline, as it can be provisioned rapidly. In contrast, a new Direct Connect connection typically takes weeks to provision. This design correctly uses the TGWs as central hubs to route traffic between all required locations: Tokyo office, Tokyo VPC, Paris VPCs, and the Paris data center.

A: This option violates the requirement that workloads not be directly accessible from the internet by using public subnets and an internet gateway.

B: A new AWS Direct Connect connection cannot be provisioned within the 5-day timeline; the process typically takes several weeks or longer.

D: This architecture is invalid. A Transit Gateway can only have VPC attachments within the same AWS Region. It cannot directly attach to a VPC in another region.

1. AWS Documentation, Amazon VPC User Guide, "Transit gateway peering attachments": "You can create a peering attachment between your transit gateways. The transit gateways can be in the same AWS Region or in different AWS Regions. ... Traffic between the Regions is sent over the AWS global network and is automatically encrypted." This supports the use of TGW peering for inter-region connectivity as proposed in option C.

2. AWS Documentation, AWS Site-to-Site VPN User Guide, "Site-to-Site VPN connections": "You can create a Site-to-Site VPN connection and configure it to work with a transit gateway. You can connect multiple VPCs and your on-premises networks to a common transit gateway, which acts as a network hub." This confirms that a Site-to-Site VPN is a valid and standard method for connecting an on-premises site to a Transit Gateway.

3. AWS Documentation, AWS Direct Connect User Guide, "Requesting a cross connect": The process described for establishing a Direct Connect connection involves coordination with an AWS Direct Connect partner and can take a significant amount of time, making it unsuitable for a 5-day deadline. The guide states, "After you have requested a connection, the AWS Direct Connect partner works with you to provision a circuit."

4. AWS Documentation, Amazon VPC User Guide, "Transit gateway attachments": Under the "VPC attachments" section, the documentation states, "You can attach a VPC in the same AWS Region as the transit gateway." This rule makes the architecture proposed in option D technically impossible.