wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

Two designs, one peering attachment

Orders run in us-east-1 and fraud scoring runs in eu-west-1. Each Region has a transit gateway with its VPCs attached, and the two transit gateways are peered so the order service can call fraud scoring privately.

Two teams built it. Both diagrams have the same boxes, the same attachments and the same peering connection. One of them carries traffic and the other has never carried a packet across the Atlantic.

Read both route tables. Choose the design that actually routes between the Regions.
!Fraud scoring times out on every cross-Region call. The peering attachment shows Available in both accounts, and both transit gateways show their VPCs correctly attached.Both diagrams are the same picture. The difference is one line in a route table, and which of these two arrangements a transit gateway actually accepts.
Design AA static route to the peer

Outside every boundary: Order service (us-east-1), Transit gateway (us-east-1), Its route table (static route), Transit gateway (eu-west-1), Fraud service (eu-west-1) Connections: Order service calls Transit gateway Transit gateway controls Its route table Its route table publishes to Transit gateway — peering attachment Transit gateway calls Fraud service

Order serviceus-east-1
Transit gatewayus-east-1
Its route tablestatic route
Transit gatewayeu-west-1
Fraud serviceeu-west-1
Design BPropagated routes only

Outside every boundary: Order service (us-east-1), Transit gateway (us-east-1), Its route table (propagated), Transit gateway (eu-west-1), Fraud service (eu-west-1) Connections: Order service calls Transit gateway Transit gateway controls Its route table Its route table publishes to Transit gateway — peering attachment Transit gateway calls Fraud service

Order serviceus-east-1
Transit gatewayus-east-1
Its route tablepropagated
Transit gatewayeu-west-1
Fraud serviceeu-west-1
Two designs, one brief. Read both, then choose the one that meets it.