Question

A financial services company runs a centralized inspection VPC using AWS Network Firewall to filter east-west traffic between multiple spoke VPCs attached to a Transit Gateway. The security team must prove to auditors that no spoke-to-spoke traffic can bypass the firewall and reach another spoke directly. During a compliance review, an auditor asks how to programmatically and continuously verify that the Transit Gateway route tables associated with spoke attachments always route inter-spoke traffic through the inspection VPC attachment. Which approach best satisfies this continuous governance requirement?

Accepted Answer

Use an AWS Config custom rule (or conformance pack) that evaluates Transit Gateway route table associations and propagations, flagging any spoke route table whose inter-spoke routes do not point to the inspection VPC attachment.

Answer

Enable VPC Flow Logs on every spoke VPC and manually review the logs weekly to confirm no direct spoke-to-spoke flows appear.

Answer

Configure Reachability Analyzer to run once during the audit to confirm the current path between two spoke VPCs traverses the inspection VPC.

Answer

Attach a restrictive network ACL to the inspection VPC subnets to block any traffic not originating from the Transit Gateway.