Question

A company uses AWS Transit Gateway to connect a Shared Services VPC (containing Active Directory and monitoring tools), three Production VPCs, and two Development VPCs. Security policy requires that Production and Development VPCs must NOT communicate with each other, but all VPCs must be able to reach the Shared Services VPC, and the Shared Services VPC must be able to reach all other VPCs. All VPCs are attached to a single Transit Gateway. How should the network engineer implement this using Transit Gateway route tables with the least administrative overhead?

Accepted Answer

Create two TGW route tables: associate Production and Development attachments with a 'Spoke' route table that only propagates the Shared Services attachment, and associate the Shared Services attachment with a 'Shared' route table that has all spoke attachments propagated into it.

Answer

Create one TGW route table shared by all attachments and use VPC security groups to block Production-to-Development traffic.

Answer

Create a separate TGW route table for every VPC attachment and manually add static routes only to the Shared Services VPC in each spoke table.

Answer

Enable route propagation for all attachments into the default TGW route table and rely on NACLs in the Shared Services VPC to control which VPCs can connect.