Your supervisor tells you of a client who needs a two-tier web application that is publicly accessible and configured on AWS. The most important requirement is that MySQL must be used as the database, and it must be configured at the client`s location in the most secure fashion. Which of the following solutions would be the best to ensure that the client’s requirements are met?

Answer options:

A.Build the application server on a public subnet and the database at the client’s data center. Connect them with a VPN connection that uses IPsec.
B.Build the application server on the private subnet and the database at the client`s data center. Connect them with a VPC peering connection.
C.Build the application server on a private subnet and the database on the public subnet with a NAT instance between them.
D.Build the application server on the private subnet and the database on the public subnet with a secure SSH connection to the public subnet from the client`s data center.

Answer – A
In this scenario, the main architectural consideration is that the database should remain on the client`s data center. Since the database should not be hosted on the cloud, you cannot put the database in the public subnet in AWS.
Option A is correct because it puts the application servers in the public subnet ( because it should be publicly accessible ) and keeps the database server at the client`s data center. This is also a valid two-tiered architecture.
Option B is INCORRECT because VPC peering cannot establish the connection between on-premises and AWS VPC.Option C is INCORRECT because the database cannot be on the public subnet. It is rather located at the client`s data center as per the question.
Option D is INCORRECT because the database cannot be on the public subnet due to the posed security risk (against the question`s requirements).
The best option is to create a VPN connection for securing traffic, as shown below.
For more information on VPN connections, please visit the below URL-
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html