GTWLB - VPC inspection, transit and aaS

Proposal: Gateway Load Balancer (GWLB) as a Shared Network Inspection Service

There are several scenarios where we would benefit from deploying a Gateway Load Balancer following the same model AWS provides natively. Key characteristics:

• Highly available load balancer for the firewall/appliance fleet
• GENEVE tunneling between the GWLB and the backend appliances (targets)
• Exposed via Private Path (Gateway Load Balancer Endpoint) for consumption from other VPCs

Scenarios to cover:

• VPC Transit — East/West and North/South traffic routed through the centralized appliance fleet
• VPC Inspection — East/West and North/South traffic, where inter-spoke traffic is steered toward the firewalls deployed in the Inspection VPC
• Firewall-as-a-Service (FWaaS) — Firewalls are exposed via a Gateway Load Balancer Endpoint (GWLBe) and consumed by other VPCs through a private connection, simplifying consumption for spoke accounts/VPCs. In this scenario, the GWLB must preserve flow stickiness, ensuring that all packets belonging to the same flow are consistently routed to the same firewall appliance.