A company has created three VPCs: a production VPC, a nonproduction VPC, and a shared services VPC. The production VPC and the nonproduction VPC must…

This configuration creates a network segmentation model using two distinct Transit Gateway (TGW) route tables. The first route table is for the production and nonproduction VPCs. By associating both VPC attachments with this table and only propagating the route from the shared services VPC, traffic originating from production or nonproduction is only permitted to travel to the shared services VPC. This effectively isolates them from each other.

The second route table is exclusively for the shared services VPC. By associating the shared services attachment with this table and propagating routes from both the production and nonproduction VPCs, it allows the shared services VPC to send return traffic to both environments, thus fulfilling all communication requirements.

B. Propagating routes from each VPC into the production/nonproduction route table would create routes between them, directly violating the requirement for isolation.

C. Associating all VPC attachments with the first route table is incorrect. The shared services VPC would use a route table that lacks routes back to production and nonproduction.

D. Disabling propagation without adding equivalent static routes would prevent the production and nonproduction VPCs from learning the path to the shared services VPC, breaking connectivity.

1. AWS Documentation: Amazon VPC User Guide, "Examples for Transit Gateway route tables". The subsection "Isolated VPCs with a shared services VPC" describes this exact scenario: "You can create a configuration in which your transit gateway has a route table for the isolated VPCs and a route table for the shared services VPC... The route table for the isolated VPCs has a route to the shared services VPC... The route table for the shared services VPC has routes to the isolated VPCs." This directly validates the two-route-table approach in answer A.

2. AWS Documentation: Amazon VPC User Guide, "How transit gateways work". This section explains the core concepts of association and propagation. It states, "Each attachment is associated with exactly one route table. Each attachment can propagate its routes to one or more route tables." The correct answer (A) properly utilizes these two distinct functions to control the flow of traffic as required.

3. AWS Whitepaper: "Building a Scalable and Secure Multi-VPC AWS Network Infrastructure" (July 2020). In the section "Network segmentation" (page 16), the paper discusses using AWS Transit Gateway to create network segments. It states, "With TGW, you can create fine-grained routing rules by creating multiple TGW route tables... This allows you to create network segments where workloads can only communicate with approved VPCs," which is the principle applied in this question.