A company has remote users who will move to Amazon WorkSpaces. WorkSpaces run in VPC A in the company's account. A network engineer wants to provide security visibility by inserting two firewall appliances behind a Gateway Load Balancer (GWLB). The engineer creates another account with VPC B and deploys the two firewall appliances in separate AZs in VPC B. What steps should the engineer take to configure network connectivity for this setup?

The correct solution involves deploying the Gateway Load Balancer (GWLB) in VPC B, where the firewall appliances reside. The GWLB endpoint is then created from this GWLB. The WorkSpaces account's ARN is added to the GWLB endpoint's principal allow list to grant access. In VPC A (WorkSpaces account), a VPC endpoint is created, referencing the service name provided by the GWLB endpoint. Finally, VPC A's route tables are configured to direct the default route to this VPC endpoint, ensuring all traffic from WorkSpaces is inspected by the firewalls in VPC B. Incorrect options: Placing the GWLB in VPC A is incorrect because the firewall appliances are in VPC B. The GWLB must be in the same VPC as its target instances. Modifying the route tables of VPC A to point only the WorkSpaces subnet to the VPC endpoint is too restrictive; the goal is to inspect all traffic, requiring a default route modification. Adding the ARN of the firewall appliance account to the principal allow list is incorrect; the WorkSpaces account needs access to the GWLB endpoint, so its ARN must be listed.