A company has started using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN. The company also has a default…

Updating the core network policy to configure segment sharing between the production and security segments is necessary to allow routes (especially return paths for internet traffic) to be properly exchanged or made visible between the segments, ensuring that traffic can flow back to the production VPC after inspection.

Creating a static route for the *security* segment with 0.0.0.0/0 as the destination and the *production* segment as the next hop would incorrectly attempt to route internet traffic *from the security segment back to the production segment*, not for inspection of production traffic.

Updating the core network policy to create a static route for the production segment with 0.0.0.0/0 as the destination and the security segment as the next hop explicitly directs all internet-bound traffic from the production segment to the security segment, forcing it through the Network Firewall in the outbound inspection VPC for inspection.

Creating a static route for the production segment with 0.0.0.0/0 pointing to the internet gateway of the outbound inspection VPC is incorrect. The next hop for a segment route in Cloud WAN should be another segment or an attachment, not a specific resource like an internet gateway directly.

Creating an attachment to attach the outbound inspection VPC to the production segment would merge the two networks and potentially bypass the intended inspection flow, rather than routing traffic between distinct segments for policy enforcement.