Question

A company runs 12 VPCs across multiple accounts in AWS Organizations. Each application VPC must reach a central shared-services VPC (containing DNS resolvers and Active Directory) but application VPCs must NOT be able to communicate with one another. The solution must scale as new VPCs are added and minimize ongoing route management overhead. Which approach best meets these requirements?

Accepted Answer

Deploy an AWS Transit Gateway and use separate route tables so application VPCs can route only to the shared-services VPC, not to each other.

Answer

Create full-mesh VPC peering connections between all VPCs and use security groups to block traffic between application VPCs.

Answer

Connect each application VPC to the shared-services VPC with individual VPC peering connections and rely on peering being non-transitive to prevent cross-VPC traffic.

Answer

Use a Site-to-Site VPN between each application VPC and the shared-services VPC, controlling access with network ACLs.