AWS NFW Walkthrough
Stand up disposable TGW hubs in Sydney and Auckland, then prove Network Firewall really double-inspects cross-Region traffic.
Build the mesh first (hubs, RAM-shared spokes, peering), prove connectivity, then attach Network Firewall deny → allow. Flow logs show same-Region traffic hit once and cross-Region traffic hit both hubs.