Question

A company runs 40 AWS accounts managed under AWS Organizations, each containing one or more VPCs. Security requires that all east-west (VPC-to-VPC) and north-south (internet egress) traffic be inspected by a fleet of third-party firewall appliances. The networking team wants a scalable design that avoids full-mesh VPC peering, centralizes the inspection appliances, and allows new spoke VPCs to be onboarded with minimal configuration. Which architecture best meets these requirements?

Accepted Answer

Deploy a Transit Gateway shared via AWS RAM, attach all spoke VPCs to it, create a dedicated inspection VPC with the firewall appliances behind a Gateway Load Balancer, and use Transit Gateway route tables to force spoke and egress traffic through the inspection VPC.

Answer

Create full-mesh VPC peering connections between all 40 accounts and deploy firewall appliances in each VPC, routing local traffic through the appliance in that VPC.

Answer

Use AWS PrivateLink to expose the firewall appliances as an endpoint service and create interface endpoints in every spoke VPC to route all traffic through the appliances.

Answer

Deploy an internet gateway and NAT gateway in each spoke VPC and enable VPC Traffic Mirroring to send copies of all packets to a central firewall VPC for inspection.