GWLB endpoint deployment

Your plan to use separate Gateway Load Balancer (GWLB) endpoints for VPC-to-VPC traffic and internet traffic inspection is a valid approach that offers better segregation, more granular control through NACLs, and clearer routing policies.

This architecture aligns with AWS best practices for traffic inspection. By separating the endpoints, you can implement different security policies and routing rules for east-west (VPC-to-VPC) traffic versus north-south (internet) traffic. This separation provides better operational clarity and can simplify troubleshooting.

For VPC-to-VPC inspection, your traffic will flow through Transit Gateway to the GWLB endpoint in the appliance VPC, where the Gateway Load Balancer will distribute traffic to your third-party firewall appliances for inspection based on a 4-tuple hash algorithm. The traffic will maintain Availability Zone affinity when possible, which helps optimize performance.

For internet traffic inspection, a separate GWLB endpoint will handle traffic flowing to and from the internet, allowing you to apply different inspection policies as needed.

While there will be a slight cost increase for the additional GWLB endpoint, the benefits of clearer segregation, more precise routing control, and potentially simpler troubleshooting likely outweigh this cost. This approach is consistent with AWS recommendations for implementing centralized inspection architectures with Gateway Load Balancer.

The only consideration would be to ensure your routing tables are properly configured to direct the appropriate traffic to each endpoint to maintain the intended traffic flow patterns.
Sources
Simplify firewall deployments using centralized inspection architecture with Gateway Load Balancer | AWS Public Sector Blog
VPC-to-VPC traffic inspection - AWS Prescriptive Guidance
Inspecting inbound traffic from the internet using firewall appliances with Gateway Load Balancer - Building a Scalable and Secure Multi-VPC AWS Network Infrastructure