Question

A company runs a multi-account AWS Organizations environment connected through a central Transit Gateway (TGW) in a dedicated networking account. There are three environments — Production, Development, and a Shared Services VPC hosting internal DNS, patch repositories, and a monitoring stack. The security team requires that Production and Development workloads must NOT be able to route traffic to each other, but both must be able to reach the Shared Services VPC, and Shared Services must be able to reach both. All VPCs are attached to the same Transit Gateway. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create separate TGW route tables: one associated with the Production and Development attachments that propagates only the Shared Services route, and one associated with the Shared Services attachment that propagates both Production and Development routes.

Answer

Use a single default TGW route table for all attachments, and apply security group rules in each VPC to block Production-to-Development traffic.

Answer

Replace the Transit Gateway with VPC peering connections from Shared Services to Production and to Development, relying on the non-transitive nature of peering to isolate the environments.

Answer

Enable appliance mode on the Shared Services attachment and route all inter-VPC traffic through a firewall in the Shared Services VPC to filter Production-to-Development flows.