Which set of steps should a solutions architect take to ensure production traffic and development traffic are completely isolated?
Modify the security groups assigned to development EC2 instances to block traffic from production EC2 instances. Modify the security groups assigned to production EC2 instances to block traffic from development EC2 instances.
Create a tag on each VPC attachment with a value of either production or development, according to the type of account being attached. Using the Network Manager feature of AWS Transit Gateway, create policies that restrict traffic between VPCs based on the value of this tag.
Create separate route tables for production and development traffic. Delete each account’s association and route propagation to the default AWS Transit Gateway route table. Attach development VPCs to the development AWS Transit Gateway route table and production VPCs to the production route table, and enable automatic route propagation on each attachment.
Create a tag on each VPC attachment with a value of either production or development, according to the type of account being attached. Modify the AWS Transit Gateway routing table to route production tagged attachments to one another and development tagged attachments to one another.
Explanations:
Security groups alone cannot fully isolate traffic between production and development accounts at the VPC level in a shared Transit Gateway environment, as they do not manage routing within the Transit Gateway.
AWS Transit Gateway Network Manager policies do not support restricting traffic between VPC attachments based on tags; Network Manager policies are intended for monitoring and analyzing network activity, not controlling VPC attachment routing.
Creating separate route tables for production and development traffic and associating the correct VPC attachments ensures that production and development accounts have isolated routing. Route propagation enables each account to access only the routes relevant to its environment.
While tags can help identify production and development attachments, Transit Gateway routing tables cannot dynamically use tags to control or restrict specific routes between VPC attachments.
I map out that the answer is:
Create separate route tables for production and development traffic. Delete each account’s association and route propagation to the default AWS Transit Gateway route table. Attach development VPCs to the development AWS Transit Gateway route table and production VPCs to the production route table, and enable automatic route propagation on each attachment.