What should the solutions architect do to meet these requirements?
Update the network ACL of each subnet within a VPC to allow outbound traffic only to the authorized VPCs. Remove all deny rules except the default deny rule.
Update all the security groups that are used within a VPC to deny outbound traffic to security groups that are used within the unauthorized VPCs.
Create a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs.
Update the main route table of each VPC to route traffic only to the authorized VPCs through the transit gateway.
Explanations:
Updating network ACLs can limit traffic at the subnet level, but this approach would not enforce inter-VPC communication restrictions effectively since VPC peering and transit gateway routes could still allow unauthorized access unless routes are also managed.
While updating security groups to deny traffic to unauthorized VPCs might seem effective, security groups operate at the instance level and do not handle routing between VPCs. Thus, this method wouldn’t adequately restrict communication between instances in different VPCs.
Creating dedicated transit gateway route tables allows for fine-grained control of traffic routing between VPCs. By routing traffic only to authorized VPCs, this approach effectively restricts inter-VPC communication based on defined policies.
Updating the main route table to route only to authorized VPCs does not address the issue directly. Traffic could still flow through the transit gateway, allowing communication between unauthorized VPCs unless route tables are specifically configured for each VPC attachment.
I calculate that the answer is:
Create a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs.
If I’m not mistaken, the answer is:
Create a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs.