The Gateway Load Balancer (GWLB) with its endpoint group (GWLBe) is the standard, scalable pattern for deploying AWS Network Firewall for east-west or north-south traffic inspection within a VPC. It simplifies routing via a single target (the GWLB) in the route table and allows the firewall to be deployed in a dedicated subnet, providing the required stateful, protocol-aware inspection for custom TCP traffic. Central VPC inspection (A) adds complexity with peering and transitive routing limits. Direct endpoint deployment (B) is not a standard or scalable pattern for this use case. An ALB with WAF (D) operates at layer 7 (HTTP/HTTPS) and cannot inspect the custom TCP protocol on port 8080.

Transit Gateway uses a routing model based on route table associations and propagations. The most effective method for hub-and-spoke isolation is to place each isolated segment (each dev VPC) in its own route table. You then associate each dev VPC’s attachment to its unique table and propagate the routes from the shared services VPC attachment into each of those tables. This allows dev-to-shared traffic but not dev-to-dev, as routes between dev VPCs are not present in their isolated tables. A single route table (A) would allow all dev VPCs to see each other. Grouping all dev VPCs together (B) would also allow inter-dev communication. Network ACLs (C) are a subnet-level, stateless control that is more operationally complex and less scalable than the TGW routing model.

In VPC Flow Logs, an action of REJECT with a response code of ‘OK’ indicates that the packet reached the destination network interface but was not accepted by an application or, crucially, by a host-based firewall. Security groups and network ACLs, if they block traffic, result in response codes like ‘NODATA’ or ‘SKIPDATA’, not ‘OK’. Therefore, the rejection is happening at the operating system level on the instance itself. AWS Network Firewall (A) would typically show in flow logs as an action from the firewall’s ENI. Routing issues (C) often manifest as no flow log entry at all for the return traffic.

A complete hybrid DNS solution with Route 53 Resolver requires two-way forwarding. 1) An *inbound endpoint* provides static IPs in your VPC that your on-premises DNS servers can forward queries to (e.g., for amazonaws.com or private VPC zones). 2) An *outbound endpoint* (or a Resolver rule associated with it) is used to conditionally forward queries from AWS to your on-premises DNS servers for your private domain (corp.example.com). Using only an inbound (B) or only an outbound (C) endpoint solves only one direction of the resolution. A Resolver rule (D) requires an outbound endpoint to be associated with, so an endpoint is necessary.

A NAT Gateway provides high availability and bandwidth but uses dynamically changing public IPs. A NAT instance, while requiring management, can have an Elastic IP (EIP) attached, providing a single, static IP address for all outbound internet traffic from the private subnets. This meets the third-party whitelisting requirement. Simply keeping the NAT Gateway (B) does not solve the static IP need. A VPC endpoint (C) is excellent if the service supports AWS PrivateLink, but the question specifies a third-party API which likely does not. A proxy server (D) adds operational overhead and a single point of failure compared to a managed NAT instance solution. An egress-only IGW (E) is for IPv6 traffic only.

A key benefit of a Direct Connect public virtual interface is that it provides a network path to AWS public services (e.g., S3, DynamoDB) in the connected region. Data transfer from on-premises to AWS public endpoints over the public VIF is charged at the Direct Connect data transfer rate, which is typically lower than internet rates, and importantly, there is no additional “Data Transfer Out” charge from AWS. This is the standard method for cost-effective access. Gateway endpoints (A) are for traffic originating within a VPC, not from on-premises via DX. While routing configuration (C) is necessary, the cost avoidance is inherent to using the public VIF, not the routing itself. Statement D is incorrect; private VIF traffic is charged at DX rates but does not provide access to public services.

AWS Transit Gateway (TGW) is the scalable service for connecting many VPCs (across accounts using Resource Access Manager). The hub-and-spoke model with a central inspection VPC connected to the TGW is a standard pattern. Deploying the Network Firewall in the central VPC using Gateway Load Balancer (GWLB) allows the TGW to route traffic from any attached VPC (spoke) to the GWLB in the inspection VPC (hub) for filtering before being routed to its destination. VPC peering (A) becomes operationally complex and doesn’t scale beyond a handful of VPCs due to the non-transitive nature of peering. PrivateLink (C) is for client-server access to services, not general transitive traffic inspection. A single large VPC (D) contradicts the multi-account segmentation strategy and creates a broad blast radius.

The simplest, most secure, and most performant method is to place both the application and the RDS instance in private subnets within the same VPC. The application connects using the RDS instance’s private DNS name, which resolves to a private IP address. This keeps all traffic within the AWS network (minimizing latency and cost) and completely off the public internet. A public IP (A) is a major security anti-pattern for a private database. An Interface Endpoint (C) is for accessing AWS services *over PrivateLink*, not for accessing your own RDS instance; it’s unnecessary here. Using an ALB (D) adds complexity, cost, and is not a standard pattern for database access.

For traffic to flow from on-premises to an instance in a private subnet, the route table of that private subnet must have a route directing traffic destined for the on-premises network CIDR to the target as the Virtual Private Gateway (VGW). This is a common oversight. If the instance can be pinged from within the VPC, its security group (A) and NACL (C) are likely correct for that test, but they should also be verified for the on-premises CIDR. However, routing is the fundamental prerequisite; if the subnet doesn’t know how to send return traffic back to on-premises (via the VGW), the connection will fail. The tunnel status (D) being UP suggests the VPN itself is established.

The Gateway Load Balancer (GWLB) with its endpoint group (GWLBe) is the standard, scalable pattern for deploying AWS Network Firewall for east-west or north-south traffic inspection within a VPC. It simplifies routing via a single target (the GWLB) in the route table and allows the firewall to be deployed in a dedicated subnet, providing the required stateful, protocol-aware inspection for custom TCP traffic. Central VPC inspection (A) adds complexity with peering and transitive routing limits. Direct endpoint deployment (B) is not a standard or scalable pattern for this use case. An ALB with WAF (D) operates at layer 7 (HTTP/HTTPS) and cannot inspect the custom TCP protocol on port 8080.0