A company has users who work from home. The company wants to move these users to Amazon WorkSpaces for additional security visibility. The company has deployed WorkSpaces in its own AWS account in VPC A. A network engineer decides to provide the security visibility by using two firewall appliances behind a Gateway Load Balancer (GWLB). The network engineer provisions another VPC, VPC B, in a separate account and deploys the two firewall appliances in separate Availability Zones. What should the network engineer do to configure the network connectivity for this solution?
Select one answer.
Marked answer: C
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose B1
I think the wording in both B and C needs a bit of correction. In B I understand the service endpoint (as per the diagram here https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/getting-started.html the endpoint will be at the consumer VPC). In Option C what doesn't make sense is to point the VPC subnet to the GWLB which I understand as creating a route with destination the local subnet and next hop the VPC Endpoint.
Chose C1
Not B. You cannot directly route to a GWLB living in VPC B.
Chose C2
Got it. Here is the short and direct version, only text: --- The correct answer is C. In a cross account GWLB setup, the provider VPC (VPC B) hosts the GWLB and exposes it through an endpoint service. The consumer VPC (VPC A) must create its own VPC endpoint of type GatewayLoadBalancer, which places ENIs locally in VPC A. Route tables in VPC A can only point to local resources, so the routes must target this local VPC endpoint, not the remote GWLB. This matches the AWS documentation for GWLB cross account deployments.
