Question

A company operates a centralized security account containing a Gateway Load Balancer (GWLB) fronting a fleet of firewall appliances. Application teams in separate AWS accounts within the same AWS Organization must route their VPC egress traffic through this inspection fleet using Gateway Load Balancer endpoints (GWLBEs) deployed in each application VPC. The networking team wants application teams to be able to create GWLBEs in their own accounts that point to the centralized GWLB, while keeping the appliance fleet fully managed in the security account. What is the correct way to enable this cross-account architecture?

Accepted Answer

Create a VPC endpoint service backed by the GWLB in the security account, then share it with the application accounts by adding their account principals to the endpoint service allowed principals; application teams create GWLBEs referencing the service name.

Answer

Use AWS Resource Access Manager (RAM) to share the Gateway Load Balancer resource directly with the application accounts so they can attach GWLBEs to it.

Answer

Establish VPC peering between the security VPC and each application VPC, then add routes in the application route tables pointing at the peering connection to reach the GWLB.

Answer

Create a Transit Gateway attachment for the GWLB in the security account and share the Transit Gateway via RAM so application accounts can route traffic to the appliances.