Client VPN with VPC peering vs Client VPN withTransit gateway

Question

A company has introduced a new policy that allows employees to work remotely from their homes if they connect by using a VPN. The company is hosting internal applications with VPCs in multiple AWS accounts. Currently, the applications are accessible from the company's on-premises office network through an AWS Site-to-Site VPN connection. The VPC in the company's main AWS account has peering connections established with VPCs in other AWS accounts.

A solutions architect must design a scalable AWS Client VPN solution for employees to use while they work from home.

What is the MOST cost-effective solution that meets these requirements?

A. Create a Client VPN endpoint in each AWS account. Configure required routing that allows access to internal applications.
B. Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications. 
C. Create a Client VPN endpoint in the main AWS account. Provision a transit gateway that is connected to each AWS account. Configure required routing that allows access to internal applications. 
D. Create a Client VPN endpoint in the main AWS account. Establish connectivity between the Client VPN endpoint and the AWS Site-to-Site VPN.

Riku_Kobayashi · Accepted Answer

Hello.

If VPC peering is already set up, I think option B will be the lowest cost.  
TransitGateway must create an attachment for each VPC, which incurs $0.05 per attachment.(TransitGateway attachment pricing varies by region.)  
Therefore, if communication routes to each VPC have already been secured through VPC peering, this may result in unnecessary costs.  
I also don't recommend creating a ClientVPN endpoint for each AWS account, as it costs more than creating one in the main VPC.  
If there are plans to add more VPCs in the future, it would be worth considering the use of Transit Gateway. However, if there are currently no plans to increase the number of VPCs, it would be better to continue using the existing VPC peering for communication.  
https://aws.amazon.com/transit-gateway/pricing/?nc1=h_ls

Client VPN with VPC peering vs Client VPN withTransit gateway

Relevant content