Question

A financial services company runs a multi-account AWS Organization with a Network Services account hosting a Transit Gateway that connects 40 application VPCs across dev, test, and prod OUs. The security team requires that all inter-VPC (east-west) traffic between production application accounts be routed through a centralized firewall appliance cluster for deep packet inspection, without requiring changes to individual application account route tables each time a new VPC is onboarded. Which architecture meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create a dedicated inspection VPC in the Network Services account with the firewall appliances, attach it to the Transit Gateway, and use separate TGW route tables that force spoke-to-spoke traffic through the inspection VPC via an appliance-mode enabled attachment.

Answer

Establish VPC peering connections between every pair of production VPCs and add security group rules referencing the firewall appliance ENIs to inspect traffic.

Answer

Deploy a Gateway Load Balancer with PrivateLink endpoints in each production application VPC and require application teams to update their route tables to send traffic to the endpoints.

Answer

Use AWS RAM to share subnets from the inspection VPC into each production account so the firewall appliances can inspect traffic locally within each VPC.