Question

A security team detects that a workload in a specific VPC has been compromised. The VPC is attached to a Transit Gateway that routes traffic between multiple VPCs and an on-premises network via a VPN attachment. The team wants to immediately isolate the compromised VPC from all other attachments and on-premises networks while preserving the ability to investigate the instances through a dedicated forensics VPC that remains reachable. What is the most effective way to achieve this using Transit Gateway features?

Accepted Answer

In the Transit Gateway route table associated with the compromised VPC's attachment, add blackhole routes for all destination CIDRs except the forensics VPC CIDR, which points to the forensics VPC attachment.

Answer

Detach the compromised VPC from the Transit Gateway and re-attach it after forensics is complete.

Answer

Modify the compromised VPC's security groups to deny all traffic, then update the Transit Gateway route table to point at the forensics VPC.

Answer

Remove the compromised VPC's route table propagations to the shared route table and rely on the default Transit Gateway route table to drop the traffic.