Synchronous replication via Metro Availability provides the lowest possible RPO (near-zero) by continuously replicating I/O to a secondary cluster before acknowledging the write to the primary application. This is the only option that offers synchronous replication, making it ideal for the most critical applications with the strictest RPO needs. Asynchronous replication (Leap) has a higher RPO, native AWS Backup operates at the EC2/disk level and is not integrated with Nutanix data management, and periodic snapshots have an RPO defined by the snapshot interval.

While Security Groups provide stateful firewall rules, and multiple VPCs create complete isolation, the fundamental and recommended construct for logical network isolation within a single VPC is the use of dedicated subnets. Nutanix best practices prescribe specific subnets for CVM management, storage/iSCSI, and VM data traffic. This allows for precise route table control, network ACL application, and clear segmentation without the overhead of managing multiple VPCs.

Nutanix Clusters on AWS for production workloads requires the use of Provisioned IOPS SSD (io1) EBS volumes for the datastore to guarantee the high, consistent performance needed for the Nutanix Distributed Storage Fabric. Furthermore, it must be deployed on Dense Storage Optimized AWS instance families (such as i3 or i3en) that provide the necessary high network bandwidth and are validated for this specific use case. gp2, st1, and sc1 volumes do not provide the required performance profile.

For remote access via Direct Connect or VPN, the Prism Element VIP must be reachable through the private IP path. The most common cause is that the subnet containing the Prism Element VIP is not being advertised via BGP over the Direct Connect Virtual Interface or included in the static routes for a VPN. While a Security Group could also block it, the scenario states the admin can access it from within the VPC, implying intra-VPC traffic works, so the issue is routing from outside the VPC. Nutanix Clusters fully supports private access via Direct Connect. An EIP is for public internet access, which is not being used here.

The Nutanix Cloud Connector (NCC) is a lightweight appliance deployed in the target AWS VPC as part of the Move setup. Its primary role is to act as a secure data gateway. It receives the VM data from the on-premises source, stages it locally, and then orchestrates the writing of that data to the target Nutanix Cluster on AWS. It does not use intermediary S3 buckets or temporary EC2 instances for the primary data staging function.

A stretched cluster architecture, where a single Nutanix cluster’s nodes are distributed across two AWS Availability Zones within the same region, provides native AZ-level resilience. In this model, the Nutanix Distributed Storage Fabric replicates data synchronously across AZs, and if one AZ fails, VMs can be restarted on nodes in the surviving AZ with minimal data loss (RPO~0). Independent clusters require Leap for replication, a single-AZ cluster is vulnerable to AZ failure, and multi-region clusters are a different, more complex configuration.

The Nutanix AWS Console Integration publishes a ‘Nutanix Cluster’ resource type to the AWS account. This enables the Nutanix Cluster to be visible and manageable as a native resource within the AWS ecosystem. This allows for integration with AWS services such as AWS CloudFormation for infrastructure-as-code deployments, AWS Systems Manager for operational insights, and AWS Service Catalog for standardized provisioning, streamlining management within the AWS toolset.

Data-at-rest encryption for the underlying EBS volumes in a Nutanix Cluster on AWS is managed entirely through AWS. During the cluster deployment process in the Nutanix Launch Wizard, you must select an AWS Key Management Service (KMS) customer-managed key (CMK). This key is then used by AWS to encrypt all EBS volumes (root and data) provisioned for the cluster. Nutanix native encryption is a separate, software-based layer, and guest VM encryption does not cover the underlying datastore.

Nutanix Calm is the application orchestration and lifecycle management platform. Its core use case is providing self-service blueprints for application and environment deployment, which can include infrastructure on Nutanix Clusters on AWS. Calm can define the entire stack (networks, VMs, software) and includes policies for automated lifecycle actions, such as scaling and, critically for this scenario, time-based expiration (lease duration) to decommission resources after a set period.

Synchronous replication via Metro Availability provides the lowest possible RPO (near-zero) by continuously replicating I/O to a secondary cluster before acknowledging the write to the primary application. This is the only option that offers synchronous replication, making it ideal for the most critical applications with the strictest RPO needs. Asynchronous replication (Leap) has a higher RPO, native AWS Backup operates at the EC2/disk level and is not integrated with Nutanix data management, and periodic snapshots have an RPO defined by the snapshot interval.0