A company has two business units (BUs) with VPCs in us-east-1 and us-west-1. Each Region currently uses a transit gateway, and the regional transit gateways are peered. The company will add more Regions and BUs, and some BUs must be isolated from others. Which architecture provides the required isolation and scales with the least operational overhead?

The correct answer is to create an AWS Cloud WAN core network with an edge location in both Regions, configure a segment for each BU with VPC attachments to the new BU VPCs, and use segment actions to control traffic between segments. This approach offers the best scalability and isolation with the least operational overhead. Cloud WAN is designed for global networks, and its segment-based architecture inherently provides strong isolation and granular control over traffic flow between BUs. Segment actions allow for explicit control over inter-segment communication, ensuring that some BUs are isolated while others can communicate as needed. Creating a new transit gateway for each BU in each Region would lead to significant operational overhead due to managing numerous transit gateways and peering connections. Attaching new VPCs to existing transit gateways and relying solely on route tables for isolation becomes complex and error-prone as the number of BUs and VPCs grows, making it difficult to enforce strict isolation policies. The option to configure segments to isolate attachments is incorrect because Cloud WAN uses segment actions to control traffic between segments, not direct attachment isolation for inter-segment communication.