Skip to content

Lesson 2: Multi-Account Transit Gateway & Centralized Egress

🧠 The Concept (Explain Like I'm 5)

Imagine 50 office buildings need to communicate with each other: * The Mesh approach (VPC Peering): You dig individual tunnels between every single building. For 50 buildings, that requires $1,225$ separate tunnels. If one route changes, chaos ensues. * The Hub & Spoke approach (Transit Gateway): You build one central Grand Central Station (The Hub). Every building digs a single tunnel to the Hub. The Hub routes traffic anywhere seamlessly.

🏢 The Enterprise Context: The $100,000 NAT Gateway Problem

In AWS, a NAT Gateway costs ~$32/month base fee PLUS data processing costs ($0.045/GB). * If you place a NAT Gateway in 100 workload accounts across 3 Availability Zones, you pay 300 NAT Gateways = $10,000+/month before processing a single byte of data! * The Platform Architect Solution: Deploy a single centralized egress VPC in your Networking Hub account. Route all outbound internet traffic from the 100 Spoke VPCs over AWS Transit Gateway through the centralized NAT Gateways. This reduces your cloud bill by 80% while centralizing egress inspection firewalls!

🗺️ Visual Architecture: Centralized Egress Hub-and-Spoke

flowchart TD
    subgraph NetHubAccount ["🏢 Central Networking Account (Shared Network)"]
        TGW["AWS Transit Gateway (TGW)"]
        HubVPC["Hub Egress VPC"]
        NAT["NAT Gateway (Public Subnet)"]
        IGW["Internet Gateway (IGW)"]

        TGW ---|"TGW Attachment"| HubVPC
        HubVPC --> NAT --> IGW
    end

    subgraph SpokeA ["📦 Workload Account A (Dev)"]
        VPC_A["Private VPC (10.1.0.0/16)<br/>No Public Subnets!"]
        AppA["EKS Cluster A"] --> VPC_A
    end

    subgraph SpokeB ["📦 Workload Account B (Prod)"]
        VPC_B["Private VPC (10.2.0.0/16)<br/>No Public Subnets!"]
        AppB["EKS Cluster B"] --> VPC_B
    end

    Internet(("🌐 Public Internet"))
    IGW --> Internet

    VPC_A -.->|"Shared via AWS RAM"| TGW
    VPC_B -.->|"Shared via AWS RAM"| TGW

🛣️ Packet Journey: From Private Pod to the Internet

sequenceDiagram
    autonumber
    actor Pod as 📦 Pod in Spoke VPC A (10.1.5.12)
    participant SpokeRT as 🧭 Spoke Route Table (0.0.0.0/0 -> tgw-xxx)
    participant TGW as 🔄 AWS Transit Gateway
    participant HubRT as 🧭 Hub Route Table (0.0.0.0/0 -> nat-xxx)
    participant NAT as 🛡️ Central NAT Gateway (Pub Subnet)
    participant WWW as 🌐 External API (e.g. GitHub / DockerHub)

    Pod->>SpokeRT: Send HTTPS packet to 140.82.121.4
    SpokeRT->>TGW: Routes over TGW Attachment
    TGW->>HubRT: Evaluates TGW Route Table
    HubRT->>NAT: Forwards to Central NAT Gateway in Hub
    NAT->>WWW: SNAT: Translates private IP to Elastic IP
    WWW-->>NAT: Response returned
    NAT-->>TGW: Routed back to TGW
    TGW-->>Pod: Packet delivered!

💻 Terraform Snippet: Sharing Transit Gateway via AWS RAM

# In the Central Networking Account:
resource "aws_ec2_transit_gateway" "main" {
  description                     = "Enterprise Transit Gateway Hub"
  default_route_table_association = "enable"
  default_route_table_propagation = "enable"
  tags = { Name = "enterprise-tgw-hub" }
}

# Share TGW with the entire AWS Organization via Resource Access Manager
resource "aws_ram_resource_share" "tgw_share" {
  name                      = "tgw-organization-share"
  allow_external_principals = false
}

resource "aws_ram_resource_association" "tgw_assoc" {
  resource_arn       = aws_ec2_transit_gateway.main.arn
  resource_share_arn = aws_ram_resource_share.tgw_share.arn
}

resource "aws_ram_principal_association" "org_assoc" {
  principal          = "arn:aws:organizations::123456789012:organization/o-abc123def"
  resource_share_arn = aws_ram_resource_share.tgw_share.arn
}

📝 Knowledge Check

Question 1

Why do enterprise architects place Transit Gateway attachments in dedicated, tiny /28 subnets inside each VPC instead of mixing them into workload subnets?

Question 2

How does a centralized Transit Gateway architecture enable zero-trust traffic inspection using an AWS Network Firewall or Palo Alto appliance?