An Australian ecommerce company hosts all of its services in the AWS Cloud and wants to expand its customer base to the United States (US). The…

The most effective solution is to create a peering connection between the Transit Gateway in ap-southeast-2 and the new Transit Gateway in us-west-1. Transit Gateway inter-region peering uses the AWS global network backbone, which is designed for high bandwidth and low, predictable latency, directly addressing the performance requirements. This is a fully managed AWS feature, which significantly minimizes the operational overhead associated with managing complex network connections, such as self-managed VPNs or multiple individual tunnels. Once peered, routes can be configured in each Transit Gateway's route table to enable seamless communication between the VPCs in both regions.

A. Creating VPN attachments over the public internet does not maximize bandwidth or minimize latency compared to using the AWS global network. It also introduces more management overhead.

C. A self-managed VPN server on EC2 instances introduces significant operational overhead for patching, scaling, and maintaining high availability, and it would not perform as well as a native AWS managed service.

D. A VPC can only be attached to a Transit Gateway that exists in the same AWS Region. This option describes a technically impossible configuration.

1. AWS Documentation, AWS Transit Gateway, "Transit gateway peering attachments": "Traffic using an inter-region transit gateway peering attachment always travels over the AWS global network and never traverses the public internet. This reduces threat vectors, such as distributed denial of service (DDoS) attacks and common exploits, such as SQL injection and cross-site scripting." This supports the performance and security benefits of peering.

2. AWS Documentation, AWS Transit Gateway, "How transit gateways work": "A transit gateway peering attachment enables you to connect two transit gateways. You can connect transit gateways in the same AWS Region or in different AWS Regions." This confirms the capability described in the correct answer.

3. AWS Documentation, AWS Transit Gateway, "Transit gateway attachments": Under the "VPC attachment" section, it states: "You can attach a VPC to your transit gateway. The VPC and the transit gateway must be in the same Region." This directly invalidates option D.

4. AWS Whitepaper, "Building a Scalable and Secure Multi-VPC AWS Network Infrastructure" (June 2020): On page 18, it discusses inter-region connectivity, stating, "AWS Transit Gateway now supports the ability to establish peering connections between Transit Gateways in different AWS Regions. This allows you to extend your connectivity and build global networks..." This highlights peering as the intended solution for this use case.