A company has a single AWS Direct Connect connection terminating at a Direct Connect location near its head office. It runs production VPCs in eu-west-1 and ap-southeast-2 and wants the on-premises network to reach private resources in both Regions over that one dedicated connection, without ordering a separate circuit for each Region. Which approach meets this requirement with the least ongoing effort?
- ACreate a private virtual interface for each VPC and attach every interface directly to the single physical Direct Connect connection in each Region.
- BOrder an additional Direct Connect connection at a location near ap-southeast-2 and attach a private virtual interface for the VPCs in that Region.
- CCreate a Direct Connect gateway, associate the virtual gateways of the VPCs in both Regions with it, and use a private virtual interface to the gateway. Correct
- DEstablish a VPC peering connection between the eu-west-1 and ap-southeast-2 VPCs and route on-premises traffic through the peering link to the remote Region.
Why A is wrong: A private VIF attaches to one VPC virtual gateway in the same Region as that gateway, so a VIF cannot span Regions, and this design does not reach ap-southeast-2 over the eu-west-1 connection.
Why B is wrong: A second circuit does reach the other Region, but it is the opposite of the stated goal of avoiding a separate connection per Region and adds recurring port and cross-connect cost.
Why C is correct: A Direct Connect gateway is a global resource that lets one private VIF reach virtual gateways of VPCs in multiple Regions over a single connection, which is exactly the multi-Region private reach required.
Why D is wrong: VPC peering joins two VPCs but is non-transitive, so on-premises traffic arriving in one Region cannot be forwarded across the peering link to reach the other Region's resources.