A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between…

The intermittent connection issue for traffic crossing Availability Zones is a classic symptom of asymmetric routing in a stateful inspection environment. Stateful appliances, like the IDS services mentioned, must see both the request and response traffic of a flow to function correctly. By default, a Transit Gateway might send the request traffic to an appliance in one AZ and the return traffic to an appliance in a different AZ. This breaks the connection state, causing packets to be dropped. Enabling "appliance mode" on the VPC attachment for the shared services VPC ensures that the Transit Gateway maintains flow stickiness, sending both forward and return traffic for a single flow to the same AZ, thus preserving routing symmetry.

A. Cross-AZ load balancing is a feature of services like Network Load Balancer, not a direct setting on a Transit Gateway VPC attachment. The problem is routing symmetry, not load distribution.

C. VPN Equal-Cost Multi-Path (ECMP) is used to load-balance traffic across multiple VPN tunnels to an on-premises network. It is not relevant for inter-VPC traffic inspection.

D. Multicast support enables one-to-many communication protocols. It does not address the unicast, stateful inspection routing problem described in the scenario.

1. AWS Documentation, Transit Gateway Guide, "Appliance in a shared services VPC": "To ensure that traffic is routed symmetrically, you can enable appliance mode on the VPC attachment for the shared services VPC. This ensures that for a given traffic flow, the transit gateway uses the same Availability Zone for the return traffic."

2. AWS Documentation, Amazon VPC User Guide, "VPC attachments": Under the section "VPC attachment options," the "Appliance mode support" is described: "Choose Enable to support a stateful network appliance in the VPC... This ensures that the same appliance is used for the forward and reverse traffic."

3. AWS Whitepaper, "Building a Scalable and Secure Multi-VPC Network Infrastructure": This paper discusses centralized inspection architectures and highlights the need for symmetric routing for stateful firewalls. It explains that Transit Gateway's appliance mode on the inspection VPC attachment is the solution to maintain this symmetry. (See section: "Centralized network security inspection").