Question

A network operations team manages a large multi-account environment with a Transit Gateway connecting 40 VPCs across two regions. They need to automatically detect and respond whenever a new VPC attachment is created or a route table association changes on the Transit Gateway, triggering a Lambda function that validates the change against a compliance policy. The solution must be event-driven with minimal polling and no custom infrastructure to watch for changes. Which approach best meets these requirements?

Accepted Answer

Enable AWS Network Manager for the global network, then create an Amazon EventBridge rule matching Network Manager topology change events to invoke the Lambda function.

Answer

Configure Transit Gateway to send VPC Flow Logs to CloudWatch Logs and create a metric filter that triggers the Lambda function when new attachment traffic is detected.

Answer

Schedule the Lambda function every five minutes using an EventBridge scheduled rule to call the DescribeTransitGatewayAttachments API and compare against the last known state.

Answer

Use Reachability Analyzer on a recurring basis to test paths through the Transit Gateway and invoke the Lambda function when a path status changes.