A company is migrating to AWS using a Transit Gateway hub-and-spoke design. Its on-premises MPLS network enforces segmentation using MPLS VPNs with VRF separation. Two 10 Gbps Direct Connect links provide resilient, high-speed connectivity. The security team needs to replicate the MPLS VRF segmentation in AWS, supporting overlapping address spaces for multiple MPLS VPNs and minimizing operational overhead. Which solution meets these requirements with the least ongoing operational effort?

The correct solution leverages Transit Gateway Connect attachments, which support Generic Routing Encapsulation (GRE) and Border Gateway Protocol (BGP) over GRE. This allows the Transit Gateway to directly exchange routes with the on-premises MPLS edge routers, importing the VRF-specific routes and maintaining segmentation. By associating each Connect attachment with a dedicated Transit Gateway route table, you can replicate the VRF separation in AWS, including support for overlapping IP addresses. This approach minimizes operational overhead because BGP dynamically propagates routes, eliminating the need for manual static route configuration. Incorrect options: SD-WAN introduces significant operational complexity and cost due to managing a new vendor solution and its virtual appliances. IPsec VPNs per MPLS VPN would require numerous Site-to-Site VPN connections, increasing management overhead and potentially exceeding limits. While Site-to-Site VPNs can terminate on a TGW, they don't inherently support VRF-like segmentation for overlapping IPs without complex routing policies. A transit VPC with VRF-aware IPsec VPNs is not a standard AWS service and would involve custom, complex routing within a VPC, which is difficult to scale and manage.