Question

A company connects three VPCs (Production, Development, and Shared-Services) to a single AWS Transit Gateway. The requirement is that Production and Development must NOT be able to reach each other, but both must be able to communicate with Shared-Services. A SysOps administrator has attached all three VPCs to the Transit Gateway. Which configuration meets the requirement?

Accepted Answer

Use two Transit Gateway route tables: associate Production and Development with one route table that only has a route (via propagation) to Shared-Services, and associate Shared-Services with a second route table that has propagated routes to both Production and Development.

Answer

Enable route propagation for all three attachments into the default Transit Gateway route table and rely on VPC security groups to block Production-to-Development traffic.

Answer

Create a single Transit Gateway route table, associate all three attachments, and add a blackhole route between the Production and Development CIDRs.

Answer

Establish VPC peering between Production and Shared-Services and between Development and Shared-Services instead of using the Transit Gateway.