How do Cloud NGFW instances get created when using AWS centralized deployments?

In a centralized Cloud NGFW for AWS deployment, a central security VPC hosts the NGFW resource. To protect other VPCs (spokes), you associate them with this central NGFW. This process creates Gateway Load Balancer (GWLB) endpoints within the subnets of the selected spoke VPCs. These endpoints act as the local "workloads" that forward traffic to the centrally managed Cloud NGFW service for inspection. Therefore, the creation process involves adding these specific NGFW components to the VPCs designated for protection.

A. vWAN and virtual hubs are components of Microsoft Azure's networking architecture, not AWS. AWS uses Transit Gateway (TGW) for similar centralized routing functions.
B. The Cloud NGFW inspects traffic routed to it; it does not functionally replace the AWS Internet Gateway (IGW), which provides VPCs with access to the internet.
D. A security VPC is a standard VPC used to host security appliances. An AWS Transit Gateway is a separate network transit hub service. A VPC is not "created as" a transit gateway.

1. Palo Alto Networks Official Documentation, "Cloud NGFW for AWS - Deployment Models": This document explicitly describes the centralized model. It states, "In a centralized model, you deploy the NGFW resource in a security VPC and use the AWS Transit Gateway (TGW) to route traffic from your spoke VPCs to the security VPC for inspection... To inspect traffic, you must create Gateway Load Balancer endpoints in the subnets of your spoke VPCs." This directly supports that workloads (endpoints) are added to selected VPCs.

Source: Palo Alto Networks, Cloud NGFW for AWS Administrator's Guide, Section: "Deployment Models".

2. Palo Alto Networks Official Documentation, "Cloud NGFW for AWS - Centralized Deployment Model": This section details the architecture, showing that the NGFW resource is in one VPC, while GWLB endpoints are deployed into the spoke VPCs that require inspection. This confirms that components are added to selected VPCs.

Source: Palo Alto Networks, Cloud NGFW for AWS Administrator's Guide, Section: "Centralized Deployment Model".

3. AWS Documentation, "What is a transit gateway?": This AWS documentation clarifies that a Transit Gateway is a distinct service that acts as a network transit hub to interconnect VPCs and on-premises networks, confirming it is not the same as a VPC.

Source: Amazon Web Services, AWS Transit Gateway User Guide, Section: "What is a transit gateway?".