Question

A retail enterprise runs several application VPCs in AWS behind a Transit Gateway. Security policy requires that all outbound internet traffic from these workloads be centrally inspected for threats and logged before leaving AWS, with no workload allowed to reach the internet through its own path. Which cloud security design should the network architect recommend for the outbound (backhaul) internet traffic?

Accepted Answer

Route all VPC egress through a centralized inspection VPC containing a next-generation firewall, with a default route pointing to the Transit Gateway and NAT/inspection performed before internet egress

Answer

Attach an internet gateway to each application VPC and apply security group rules to filter outbound traffic per instance

Answer

Enable AWS PrivateLink endpoints in each application VPC so outbound internet traffic is tunneled privately to AWS services

Answer

Use VPC peering between all application VPCs and allow each VPC to reach the internet through the peer with the shortest path