A solutions architect must add centrally managed, rule-based filtering for outbound internet traffic for all AWS accounts in an AWS Organization. The organization has more than 100 accounts, uses a centralized AWS Transit Gateway for routing between accounts, each account has an internet gateway and a NAT gateway, and all resources are in a single Region. Peak outbound traffic will not exceed 25 Gbps per Availability Zone. Which solution meets these requirements?

The correct solution leverages AWS Network Firewall for centralized, rule-based filtering. By creating a dedicated VPC for outbound traffic and attaching the Transit Gateway, all accounts can route their internet-bound traffic through this central point. AWS Network Firewall, deployed with endpoints in each Availability Zone, provides the necessary rule-based filtering and scales automatically to handle the 25 Gbps peak traffic. Updating default routes to point to the Network Firewall endpoints ensures all outbound traffic is inspected. The option with EC2 instances running an open-source proxy is less scalable and requires more operational overhead for management and patching compared to Network Firewall. Deploying Network Firewall or EC2 proxies in each account is not centrally managed and would be complex to implement and maintain across 100+ accounts, contradicting the requirement for centralized management.