Preventing Dropped TGW Traffic with Network ACLs and Lambda

Why the Answer Is Correct

Option A is correct because the traffic identified in the flow logs is being dropped by the transit gateway, meaning it is outbound traffic from the VPC. To block it from leaving, you must create an outbound network ACL rule on the transit gateway attachment subnets. Outbound rules are evaluated based on the destination IP address. By adding the destination IP addresses of the dropped traffic to the SNS notification, the new Lambda function can create an outbound deny rule that matches those destinations, effectively preventing the traffic from leaving the VPC.

The comments supporting A correctly point out that “destination IP addresses identify where the problematic traffic is trying to go” and that “outbound rules prevent traffic from leaving the VPC.” This aligns with AWS network ACL semantics: an outbound rule uses the destination field, not the source field.

Why the Other Options Are Wrong

Option B is wrong because it uses source IP addresses and an inbound rule. Inbound rules apply to traffic entering a subnet, not leaving it, and they filter by source IP. This would not stop outbound traffic. Option C is the most tempting but fundamentally incorrect: outbound NACL rules do not have a “source” field; they only use destination addresses. Creating an outbound rule with source IP addresses is impossible in the AWS console or API. Option D is wrong because inbound rules use source IPs, not destination IPs, and the goal is to block outbound traffic.

One commenter voted C, saying “traffic is going out from EC2, need to identify the source,” but this misunderstands NACL outbound rule fields. While the source EC2 instance is indeed where the traffic originates, a NACL cannot match on source for egress traffic; it matches on destination. The commenter also suggested attaching an outbound constraint to the subnet ACL, which is correct in direction but uses the wrong IP field.

Community Comment Notes

A highly-liked comment explains A succinctly: adding a NACL outbound rule stops traffic from the VPC where it's generated, using the destination address because “only IP settable for outbound rules.” Another liked comment highlights the combination of destination IPs and outbound rules as the correct automation. The minority C voters focused on the source EC2 instance, but they missed the technical limitation of NACL outbound rules. The majority consensus (71%) chose A, and the correct AWS documentation confirms that outbound rules filter based on destination IP.

Overall, the key to this question is remembering that NACLs are stateless and each direction has a different set of filter fields. For egress traffic, you must use an outbound rule with a destination IP.