An enterprise is designing a centralized egress inspection architecture using AWS Transit … — AWS Certified Solutions Architect - Professional

An enterprise is designing a centralized egress inspection architecture using AWS Transit Gateway (TGW) to connect 50 spoke VPCs (CIDR range $10.0.0.0/8$ ) to a central Inspection VPC (CIDR range $172.16.0.0/16$ ). The Inspection VPC contains a Gateway Load Balancer (GWLB) backed by stateful firewalls to inspect all outbound traffic before it goes to the internet through NAT Gateways. The Inspection VPC is deployed across multiple Availability Zones, with each zone containing a TGW subnet, a GWLB endpoint (GWLBe) subnet, and a NAT Gateway subnet. Which configuration of Transit Gateway (TGW) route tables and Inspection VPC route tables must the solutions architect implement to ensure that all egress traffic is inspected and returned symmetrically without routing loops or dropping packets?

Associate the spoke VPCs with a Spoke TGW Route Table containing a default route ( $0.0.0.0/0$ ) to the Inspection VPC attachment. Associate the Inspection VPC with an Inspection TGW Route Table containing a route for $10.0.0.0/8$ pointing to the spoke VPC attachments. In the Inspection VPC, configure the TGW subnet route tables with $0.0.0.0/0 \rightarrow GWLBe$ ; the GWLBe subnet route tables with $0.0.0.0/0 \rightarrow NAT\ Gateway$ and $10.0.0.0/8 \rightarrow TGW$ ; and the NAT Gateway subnet route tables with $0.0.0.0/0 \rightarrow IGW$ and $10.0.0.0/8 \rightarrow GWLBe$ .Answer
B
Associate all spoke VPCs and the Inspection VPC with a single TGW Route Table containing a default route ( $0.0.0.0/0$ ) pointing to the Inspection VPC attachment. In the Inspection VPC, configure the TGW subnet route tables with $0.0.0.0/0 \rightarrow GWLBe$ ; the GWLBe subnet route tables with $0.0.0.0/0 \rightarrow NAT\ Gateway$ and $10.0.0.0/8 \rightarrow TGW$ ; and the NAT Gateway subnet route tables with $0.0.0.0/0 \rightarrow IGW$ and $10.0.0.0/8 \rightarrow TGW$ .
C
Associate the spoke VPCs with a Spoke TGW Route Table containing a default route ( $0.0.0.0/0$ ) to the Inspection VPC attachment. Associate the Inspection VPC with an Inspection TGW Route Table containing a route for $10.0.0.0/8$ pointing to the spoke VPC attachments. In the Inspection VPC, route the TGW subnet route tables with $0.0.0.0/0 \rightarrow NAT\ Gateway$ deployed in a single Availability Zone. Configure the GWLBe subnet route tables with $0.0.0.0/0 \rightarrow TGW$ , and the NAT Gateway subnet route tables with $0.0.0.0/0 \rightarrow IGW$ and $10.0.0.0/8 \rightarrow TGW$ .
D
Associate the spoke VPCs with a Spoke TGW Route Table containing a default route ( $0.0.0.0/0$ ) to the Inspection VPC attachment. Associate the Inspection VPC with an Inspection TGW Route Table containing a route for $10.0.0.0/8$ pointing to the spoke VPC attachments. In the Inspection VPC, configure the TGW subnet route tables with $0.0.0.0/0 \rightarrow GWLBe$ ; the GWLBe subnet route tables with $0.0.0.0/0 \rightarrow NAT\ Gateway$ and associate a Route 53 Private Hosted Zone (PHZ) for name resolution; and the NAT Gateway subnet route tables with $0.0.0.0/0 \rightarrow IGW$ and no explicit routes for $10.0.0.0/8$ , relying on the local VPC route.

Answer

Associate the spoke VPCs with a TGW route table that routes default traffic (

0.0.0.0/0

) to the Inspection VPC, and associate the Inspection VPC with a separate TGW route table containing routes for the spoke CIDR (

10.0.0.0/8

) pointing to the spoke attachments. In the Inspection VPC, configure the TGW subnets to route

0.0.0.0/0

to the GWLBe; the GWLBe subnets to route

0.0.0.0/0

to the NAT Gateway and

10.0.0.0/8

to the TGW; and the NAT Gateway subnets to route

0.0.0.0/0

to the IGW and

10.0.0.0/8

to the GWLBe.

The correct configuration uses two separate TGW route tables to prevent routing loops. In the Inspection VPC, traffic from the TGW is directed to the GWLBe for inspection. Once inspected, it is sent to the NAT Gateway and then the IGW. For return traffic, the NAT Gateway subnet routes the spoke CIDR (

10.0.0.0/8

) back to the GWLBe to maintain stateful symmetry, and the GWLBe subnet routes that traffic back to the TGW, which forwards it to the correct spoke VPC.

Step-by-Step Solution

Separate the Transit Gateway route tables for the spoke VPCs and the Inspection VPC.

Two distinct TGW route tables: Spoke TGW Route Table with a default route (

0.0.0.0/0

) pointing to the Inspection VPC, and Inspection TGW Route Table with routes for

10.0.0.0/8

pointing to the spoke VPCs.

This prevents routing loops when return traffic is sent from the Inspection VPC back to the Transit Gateway.

Configure the outbound routing in the Inspection VPC subnets.

TGW subnet routes

0.0.0.0/0

to the GWLBe. GWLBe subnet routes

0.0.0.0/0

to the NAT Gateway. NAT Gateway subnet routes

0.0.0.0/0

to the IGW.

This forces all outbound traffic arriving from the spokes to go through the GWLB endpoints for firewall inspection before reaching the NAT Gateway and the internet.

Configure the inbound (return) routing in the Inspection VPC subnets for symmetric flow.

NAT Gateway subnet routes

10.0.0.0/8

to the GWLBe. GWLBe subnet routes

10.0.0.0/8

to the TGW.

This ensures that return traffic from the internet is sent back through the same stateful firewalls via the GWLBe before being sent back to the TGW and the spoke VPCs, maintaining flow symmetry.

Key Concept

Centralized egress security inspection with Gateway Load Balancer and AWS Transit Gateway

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic