A network engineer is designing an active–passive AWS connection from two on-prem data centers. Each site has a Direct Connect transit VIF to a Direct Connect gateway associated with a transit gateway. Traffic from AWS to the on-prem data centers must prefer the primary data center and only go to the failover site during an outage. Which configuration accomplishes this?

AWS Direct Connect uses BGP community tags to influence routing preferences. The 7224:7300 community tag indicates a high preference (Local Preference 300), making routes associated with it preferred. The 7224:7100 community tag indicates a low preference (Local Preference 100), making routes associated with it less preferred. To achieve active-passive failover, the primary data center's prefixes should be tagged with 7224:7300 for higher preference, and the failover data center's prefixes with 7224:7100 for lower preference. This ensures traffic from AWS prefers the primary site and only fails over to the secondary if the primary becomes unavailable. The other options use incorrect community tags or reverse the preference, leading to unintended routing behavior or no preference at all.