Question

A company operates three VPCs: a Shared Services VPC (containing DNS resolvers and a centralized logging endpoint), a Production VPC, and a Development VPC. Security policy requires that both Production and Development can reach the Shared Services VPC, but Production and Development must NOT be able to communicate with each other under any circumstance. All three VPCs are connected through a single AWS Transit Gateway. A security engineer must enforce this isolation with the least operational overhead while keeping all traffic on the Transit Gateway. What is the MOST appropriate configuration?

Accepted Answer

Create two Transit Gateway route tables: associate the Production and Development attachments with a route table that only propagates the Shared Services route, and associate the Shared Services attachment with a route table that propagates both Production and Development routes.

Answer

Associate all three VPC attachments with a single Transit Gateway route table and rely on security groups in each VPC to block Production-to-Development traffic.

Answer

Replace the Transit Gateway with VPC peering connections between Shared Services and each spoke VPC, and add deny-all NACLs in Production and Development.

Answer

Enable appliance mode on the Transit Gateway and route all inter-VPC traffic through a firewall in the Shared Services VPC to inspect and drop Production-to-Development flows.