Question

A company connects five production VPCs and an on-premises data center through an AWS Transit Gateway. Security requires that all traffic between VPCs (east-west) be inspected by a firewall appliance before being forwarded to its destination. The team deploys a dedicated inspection VPC containing AWS Network Firewall endpoints. Which Transit Gateway routing configuration ensures east-west traffic is forced through the inspection VPC?

Accepted Answer

Attach the inspection VPC to the Transit Gateway and use separate Transit Gateway route tables so that spoke VPC routes point to the inspection VPC attachment, while the inspection VPC route table returns traffic to the destination spoke.

Answer

Enable Transit Gateway multicast and route all traffic to a single default route table shared by every VPC attachment.

Answer

Add a security group on the Transit Gateway attachment ENI that references the inspection VPC's Network Firewall endpoints.

Answer

Configure each spoke VPC's local route table with a route pointing 0.0.0.0/0 to the Transit Gateway and rely on default appliance mode to inspect traffic.