Question

Your company uses Network Connectivity Center with a single hub to connect four regional VPC spokes. Currently all spokes can communicate with each other in a full mesh. A new security requirement mandates that two of the spokes (spoke-C and spoke-D) must only be able to reach spoke-A (a shared services VPC) and must NOT be able to reach each other or spoke-B. You want to enforce this at the connectivity layer without deploying firewall appliances. What should you do?

Accepted Answer

Create a new Network Connectivity Center hub configured for star topology (topology is set at hub creation and cannot be changed in place), designating spoke-A as the center and spoke-C/spoke-D as edge spokes so they can only communicate with the center spoke.

Answer

Create a second Network Connectivity Center hub and move spoke-C and spoke-D to it, then peer the two hubs together.

Answer

Keep the mesh topology and rely on VPC Network Peering export/import route filtering between spoke-C, spoke-D, and spoke-B.

Answer

Add hierarchical firewall policies at the organization level that block traffic between spoke-C, spoke-D, and spoke-B.