A network engineer needs to improve the network security of an existing AWS environment by adding an AWS Network Firewall firewall to control internet-bound traffic. The AWS environment consists of…

A centralized inspection VPC is a valid design but typically involves more significant routing changes across multiple VPCs, potentially leading to more disruption than a decentralized, per-VPC deployment when minimizing changes to the existing production environment is a priority.

Configuring new, dedicated subnets in two Availability Zones within each VPC allows for the deployment of highly available Network Firewall endpoints without interfering with existing production subnets. This decentralized approach minimizes changes to the core application infrastructure while providing a firewall presence in each VPC.

Deploying Network Firewall endpoints into *existing* subnets is generally not recommended as firewall endpoints require dedicated subnets to avoid IP address conflicts and ensure proper network segregation, leading to potential operational issues.

Updating the route tables associated with *private subnets* directly to the Network Firewall is incorrect because private subnets are typically routed through NAT gateways for internet access. The routing changes for outbound internet traffic should occur in the route tables of the *public subnets* hosting the NAT gateways.

Updating the route tables associated with the public subnets (where NAT gateways reside) to point internet-bound egress traffic to the Network Firewall endpoints, and updating the Internet Gateway's route tables to point ingress traffic to the firewall, ensures all internet-bound traffic (inbound and outbound) passes through the Network Firewall for inspection, supporting rules for public IP addresses.