A company deployed stateful IDS instances across three Availability Zones in a shared services VPC for traffic inspection of VPC-to-VPC traffic that flows through a transit gateway. After configuring transit gateway associations and routes, some test VPCs experienced intermittent cross–Availability Zone connections. What change should a network engineer make to fix this issue?

Enabling appliance mode support on the transit gateway VPC attachment for the shared services VPC is crucial for stateful appliances like IDS. Without appliance mode, the transit gateway might distribute traffic for the same flow across different appliance instances in various Availability Zones, breaking the stateful connection and causing intermittent issues. Appliance mode ensures that traffic for a given flow consistently returns to the same appliance instance, maintaining state. Cross-Availability Zone load balancing is not directly applicable here as the issue is about maintaining flow state with a specific appliance, not general load distribution. VPN ECMP and multicast support are unrelated to the problem of maintaining stateful connections through an IDS appliance.