A logistics company has multiple VPCs in a Region connected through a transit gateway. Several on-prem offices connect to the transit gateway using Site-to-Site VPN over the internet; each office has one transit gateway VPN attachment and two tunnels in an active-passive setup. The offices use static routes on both the VPN and the customer gateway. The company wants to use both IPsec tunnels for each office simultaneously to maximize total VPN bandwidth. What design changes are needed to achieve this?

The correct answer enables ECMP on the transit gateway and customer gateways and switches to BGP routing. ECMP allows traffic to be distributed across multiple paths (both VPN tunnels) for increased bandwidth. For ECMP to function with Site-to-Site VPNs, BGP must be used to advertise routes, as static routes do not inherently support load balancing across multiple tunnels in an active-active fashion. The customer gateway must also be configured to support ECMP. The first incorrect option describes Transit Gateway Connect, which is designed for high-bandwidth connectivity to third-party appliances within AWS, not for direct Site-to-Site VPN ECMP. The second incorrect option suggests enabling ECMP with static routes, which is not supported for active-active load balancing across both tunnels of a Site-to-Site VPN. The fourth incorrect option incorrectly mentions community strings for ECMP forwarding; while BGP community strings are used for route manipulation, they are not directly responsible for enabling ECMP forwarding itself in this context. ECMP is enabled by having multiple equal-cost paths advertised via BGP.