Segmentation, Traffic Monitoring, and Service Endpoints

Segmentation starts with addresses you will never overlap

Every later choice—Transit Gateway attachments, Direct Connect allowed prefixes, EKS prefix delegation—assumes unique IPv4 (and IPv6) space in the routed domain. Amazon VPC IP Address Manager (IPAM) is how a professional organization allocates RFC1918 and public pools across OUs instead of letting each account pick 10.0.0.0/16. Reserve summaries for on-premises, for future Regions, for shared-services VPCs, and for an inspection VPC. Leave headroom inside each VPC for interface endpoints, Transit Gateway attachment /28s, firewall endpoint subnets, and container ENIs. Amazon ECS and Amazon EKS in awsvpc mode consume IPs per task or pod; prefix assignment on the VPC CNI multiplies addresses per node. If IPAM is an afterthought, the first overlapping acquisition CIDR forces an emergency PrivateLink exception instead of a planned re-IP.

Subnetting is a security control as well as an addressing exercise. Separate workload, endpoint, Transit Gateway attachment, and firewall/GWLB subnets. Do not colocate firewall endpoints in the same subnet as application ENIs: AWS Network Firewall cannot inspect traffic that originates or terminates in the firewall subnet itself. Keep Transit Gateway attachment NACLs open; put deny-lists on workload NACLs if you still use NACLs at all. Most segmentation at this exam level lives in transit gateway route tables and security groups, with NACLs as coarse stateless backup.

IPv6 dual-stack does not remove the need for uniqueness. Transit Gateway and Direct Connect support IPv6, but overlapping unique-local ranges recreate the same attachment failures. If a stem requires on-premises that is IPv4-only, plan NAT or proxy at an egress hub rather than assuming Cloud WAN will translate silently.

Centralized inspection: Network Firewall versus Gateway Load Balancer

East-west (VPC-to-VPC) and north-south (VPC-to-on-premises or VPC-to-internet) inspection at organization scale uses a hub, not a firewall in every spoke.

AWS Network Firewall is a managed, stateful firewall and IPS that uses Suricata-compatible rules. In the classic pattern you create an inspection VPC with, per AZ: a Transit Gateway attachment subnet and a dedicated firewall endpoint subnet. Spoke transit gateway route tables send traffic that must be inspected to the inspection attachment. Inside the inspection VPC, the attachment subnet route table sends traffic to the firewall endpoint; after inspection, routes return traffic to the Transit Gateway. Enable appliance mode on the inspection attachment so stateful rules see both directions. AWS documents source-preservation behavior in the default operating mode: original IPs remain visible, which is what you want for 5-tuple and IDS policy. Firewall Manager can deploy Network Firewall policy across AWS Organizations. AWS also documents a network function attachment that connects Network Firewall directly to a Transit Gateway with AWS-managed buffer infrastructure and automatic appliance mode; that path uses static routing and is not a third-party appliance farm.

Gateway Load Balancer (GWLB) is the pattern when the stem names third-party next-generation firewalls or IDS appliances. Appliances register as GWLB targets. Gateway Load Balancer endpoints (a PrivateLink-powered routable target) sit in the inspection VPC (or in edge VPCs for ingress). Transit Gateway appliance mode again keeps flow symmetry. You own scaling and patching of the virtual appliances; AWS owns the load balancer. GWLB is also how many vendors publish an AWS Marketplace appliance service.

Choose Network Firewall when you want AWS-managed Suricata policy, Firewall Manager, and fewer moving parts. Choose GWLB when a compliance program names a specific vendor engine or when you already operate that fleet. Do not put both in series “for extra safety” unless you have an explicit layered-inspection requirement; double hairpins add MTU, timeout, and cost failure modes.

Internet egress often combines inspection with NAT gateway. A common hub is: spoke → Transit Gateway → inspection (Network Firewall or GWLB) → NAT gateway → internet gateway. Ingress inspection can use Gateway Load Balancer endpoints in an edge VPC with VPC ingress routing so packets from an internet gateway go to appliances before application targets. Those patterns are still Task 1.1 segmentation: the question is where the choke point lives.

Traffic monitoring: flow logs versus Traffic Mirroring

VPC flow logs capture metadata about accepted and rejected traffic at the ENI, subnet, or VPC level: 5-tuple, bytes, action, and related fields depending on format version. They do not capture payloads. Use them to answer “did the security group or NACL drop this?” and “did packets leave this ENI toward the Transit Gateway?” Send logs to CloudWatch Logs or S3; in organizations, centralize in a logging account. Flow logs will not explain a TLS handshake failure inside an allowed flow.

Amazon VPC Traffic Mirroring copies network packets from a source ENI (or NLB/GWLB constructs in supported setups) to a target such as another ENI, a Network Load Balancer, or a Gateway Load Balancer endpoint. That is how you feed a packet-level IDS or forensic appliance. Mirroring has source filters and VXLAN encapsulation to the target; it is not a substitute for a routing-based inspection hub, and it is not free of bandwidth cost. Use mirroring when the stem requires payload inspection or packet capture, and flow logs when the stem requires allow/deny attribution.

For hybrid paths, also use Transit Gateway flow logs (where enabled in your account) and Direct Connect/VPN CloudWatch metrics. BGP session down, prefix count, and tunnel state explain “on-premises cannot reach VPC” faster than guessing at security groups.

Interface endpoints, gateway endpoints, and PrivateLink integrations

Workloads in private subnets should reach AWS APIs without a NAT gateway whenever an endpoint exists.

Gateway endpoints do not use security groups; you constrain them with endpoint policies and route-table placement. Interface endpoints do use security groups; a locked-down endpoint security group is a common reason “the VPC endpoint is available” but applications still time out. Enable private DNS on interface endpoints so AWS SDK default hostnames resolve to the endpoint. For Amazon S3, gateway endpoints remain the usual data-path answer from EC2 in the same Region; interface endpoints for S3 appear when you need PrivateLink features such as access from on-premises over Direct Connect without a gateway route, or specific S3 endpoint capabilities AWS documents for interface mode. Do not send S3 data plane out a NAT gateway in every spoke when a gateway endpoint in the spoke (or a centralized egress design you have actually modeled) would remove that charge and that failure domain.

PrivateLink is also how you publish your service: NLB plus endpoint service plus consumer endpoints. Combine that with inspection carefully: consumers connect to an endpoint ENI in their VPC; the provider NLB is in the provider VPC. If policy requires inspecting that traffic, inspect on the provider side or use a proxy architecture—you cannot magically hairpin PrivateLink through a Transit Gateway the way you hairpin RFC1918.

Troubleshooting traffic flows

Walk the packet in order. Inventing a second CIDR is not a troubleshooting step.

1. Source AZ and attachment. Does the source subnet’s AZ have a Transit Gateway attachment ENI? If not, the instance cannot send to the gateway.
2. VPC subnet route table. Is there a route for the destination CIDR (or default) whose target is the transit gateway, virtual private gateway, VPC endpoint, or GWLB endpoint you intend?
3. Transit gateway route table association. The source attachment’s associated table must contain the destination prefix pointing at the correct next attachment—not a blackhole, not the wrong environment table.
4. Propagation versus static. If you expected BGP from Direct Connect and the prefix is missing, check Direct Connect gateway allowed prefixes, VIF state, and whether a static overlapping route is hiding the propagated path.
5. Return path. Appliance mode, stateful security groups (they are stateful), and stateless NACLs on both directions. Asymmetric inspection without appliance mode looks like “random” drops.
6. Security groups and endpoint policies. Interface endpoints, inbound Resolver ENIs, and NLB security groups fail closed.
7. MTU. Jumbo frames across a VPN (1500) or a middlebox that clamps MSS will drop silently if applications send 9001-byte packets that worked on peering.
8. DNS. If TCP 443 never starts, check Resolver rules and private DNS on endpoints before you rebuild the Transit Gateway.

VPC flow logs at the source ENI with REJECT point to SG/NACL. ACCEPT at the source with no packets at the destination points to routing, including transit gateway tables. Traffic Mirroring or a packet capture on the firewall confirms whether inspection is dropping after routing succeeded.

Scenario: inspection insert that blackholes east-west

A platform team attached an inspection VPC and changed every spoke transit gateway route table so 0.0.0.0/0 and all spoke summaries point at the inspection attachment. After cutover, spoke-to-spoke API calls fail. Flow logs show ACCEPT on the source ENI. The inspection VPC attachment was created in two AZs but appliance mode was off; return traffic landed on a firewall that had no state. A second issue hid behind the first: the inspection VPC’s Transit Gateway subnet route table sent 0.0.0.0/0 back to the transit gateway before the firewall endpoint, so packets never reached Suricata. The fix is dedicated firewall subnets, routes from the attachment subnet to the firewall endpoint, return routes from firewall subnets to the transit gateway, appliance mode on, and spoke tables that send only the prefixes that must be inspected (or an explicit default) without blackholing shared-services CIDRs that were supposed to bypass inspection. Add gateway endpoints for S3 in the spokes so backup traffic does not hairpin the firewall farm unless policy requires it.