An AWS Site-to-Site VPN connection is configured to carry either IPv4 or IPv6 traffic inside the tunnel, but not both simultaneously. This is determined by the InsideIpVersion parameter, which is immutable after the VPN connection is created. To support the new IPv6 workloads while maintaining the existing IPv4 connectivity, a new, separate Site-to-Site VPN connection must be created specifically for IPv6 traffic. This new connection will have its InsideIpVersion parameter set to ipv6. This is the standard AWS-managed approach and represents the least operational overhead compared to building and maintaining a custom solution.

B. A self-managed EC2 instance for VPN introduces significant operational overhead for patching, high availability, and management, which contradicts the requirement for the least overhead.

C. The traffic version (IPv4 or IPv6) inside a VPN tunnel is an immutable property. An existing Site-to-Site VPN connection cannot be updated to change this setting.

D. The customer gateway's public IP address is for the tunnel's outer encapsulation. Changing it does not affect the type of traffic (IPv4 vs. IPv6) allowed inside the tunnel.

1. AWS Site-to-Site VPN User Guide: In the section "IPv6 traffic over a Site-to-Site VPN connection," the documentation states, "A single Site-to-Site VPN connection tunnel supports either IPv4 or IPv6 traffic, but not both at the same time. To support both IPv4 and IPv6 traffic, create a Site-to-Site VPN connection for IPv4 traffic, and a separate Site-to-Site VPN connection for IPv6 traffic."

2. Amazon EC2 API Reference, CreateVpnConnection: The documentation for this API call specifies the VpnTunnelOptions parameter, which includes InsideIpVersion. This parameter must be set to ipv4 or ipv6 at the time of creation.

3. Amazon EC2 API Reference, ModifyVpnConnection: The documentation for modifying a VPN connection does not list InsideIpVersion or its parent VpnTunnelOptions as a modifiable parameter, confirming its immutability after creation.