Question

A company runs multiple application VPCs connected through a Transit Gateway to a central egress VPC that provides internet access via NAT gateways. Security requires all outbound traffic from every application VPC to be inspected by AWS Network Firewall before reaching the internet, with a single centrally managed firewall policy. Which architecture meets this requirement most effectively?

Accepted Answer

Deploy AWS Network Firewall endpoints in a dedicated inspection VPC attached to the Transit Gateway, and use Transit Gateway route tables to route application VPC traffic through the inspection VPC before reaching the egress VPC's NAT gateways.

Answer

Deploy a separate AWS Network Firewall in each application VPC and replicate an identical firewall policy to each firewall using a CloudFormation StackSet.

Answer

Attach an AWS WAF Web ACL to each NAT gateway in the central egress VPC to inspect outbound traffic against the managed firewall policy.

Answer

Route all application VPC traffic through a single security group referencing the Network Firewall endpoint's elastic network interface in the egress VPC.