A company with multiple accounts and VPCs connected through a Transit Gateway needs deep packet inspection (DPI) for any traffic leaving a VPC boundary. All inspected traffic and DPI actions must be logged centrally in a log account. Which design meets these needs while minimizing administrative overhead?

The correct option centralizes deep packet inspection (DPI) using a Gateway Load Balancer (GWLB) in a dedicated network VPC. GWLB is specifically designed to transparently insert third-party virtual appliances, like next-generation firewalls, into the network path, enabling DPI for all traffic traversing the Transit Gateway. Routing traffic through this central VPC ensures all inter-VPC and outbound traffic is inspected. Configuring the firewall appliances to send logs to an S3 bucket in a central log account provides a scalable and cost-effective logging solution. The incorrect options fail for several reasons: Using an Application Load Balancer is unsuitable for transparent network inspection at the packet level; it operates at Layer 7. Sending logs to a syslog server is less scalable and resilient than S3 for centralized logging. Network ACLs and security groups provide stateless and stateful filtering, respectively, but do not perform deep packet inspection. VPC Flow Logs capture metadata, not the packet content needed for DPI. A central log VPC is not where inspection appliances would reside. While VPC Traffic Mirroring can send traffic for inspection, it adds significant administrative overhead by requiring configuration on every ENI in every VPC, and a Network Load Balancer is not designed for transparent appliance insertion like GWLB.