Question

A company runs 40 workload VPCs across a single AWS Region, all attached to a Transit Gateway (TGW). Security policy requires that all outbound internet traffic and all inter-VPC (east-west) traffic pass through a centralized firewall appliance fleet before reaching its destination. The team wants a scalable design that avoids deploying NAT gateways and firewalls in every workload VPC. Which design best meets these requirements?

Accepted Answer

Create a dedicated inspection VPC containing the firewall appliances and NAT gateways, attach it to the TGW, and use TGW route tables so that workload VPC traffic is routed to the inspection VPC attachment for both east-west and egress flows.

Answer

Enable appliance mode on each workload VPC attachment and add a default route in every workload VPC pointing to an internet gateway, while peering all VPCs to each other for east-west inspection.

Answer

Deploy the firewall appliances in a Gateway Load Balancer endpoint inside every workload VPC and disable the TGW so traffic stays local to each VPC.

Answer

Use VPC peering between all 40 VPCs in a full mesh and route egress through a single workload VPC's NAT gateway without any firewall inspection.