How would you segment prod, dev and shared services on a transit gateway, and where does inspection fit?
Show the answer
Say this first
I use separate TGW route tables. Prod attachments associate with a prod table that learns prod, shared services and on-prem routes. Dev associates with a dev table that learns dev and shared services only. Shared services learns everything. For inspection, spoke tables send traffic to an inspection VPC attachment, and I turn on appliance mode on that attachment so both directions of a flow hit the same firewall in the same AZ.
Go deeper
Route tables
| TGW route table | Associated attachments | Propagations from |
|---|---|---|
| rt-prod | prod VPCs | prod VPCs, shared VPC, VPN or DX |
| rt-dev | dev VPCs | dev VPCs, shared VPC |
| rt-shared | shared services VPC | prod, dev, VPN or DX |
Prod and dev never learn each other's routes, so there is no path. That is routing-based isolation; security groups still apply inside.
Blackhole routes
If a spoke table has 0.0.0.0/0 to a central egress VPC, I add a blackhole route for the internal
supernet (for example 10.0.0.0/8). Traffic to an internal range nobody has propagated is dropped
at the TGW instead of wandering toward the NAT gateways. Longer propagated routes still win by longest
prefix match.
Inspection VPC
- Spoke tables have
0.0.0.0/0(or the internal supernet) to the inspection VPC attachment. - The inspection VPC sends traffic through AWS Network Firewall endpoints or a Gateway Load Balancer with third-party firewalls, then back to the TGW.
- The inspection attachment is associated with a table that knows all spoke routes.
Why appliance mode
By default a TGW keeps traffic in the AZ where it entered. If the source is in AZ a and the destination in AZ b, the request enters the inspection VPC in AZ a and the reply in AZ b. Two different firewalls see the two halves; the stateful one that sees the reply has no session and drops it. With appliance mode enabled on the inspection VPC attachment, the TGW picks one AZ for the flow and uses it for both directions.
They will ask next
Which wins on a TGW, a static route or a propagated route for the same prefix?
The static route. Longest prefix match still comes first.
How do you let dev reach one prod service without opening prod?
Do not propagate prod into rt-dev. Publish the service through PrivateLink, or add only that service's /32 or small prefix as a static route and enforce it with the firewall and security groups.
Traps
- Forgetting appliance mode and seeing random drops only for cross-AZ flows.
- Treating TGW route tables as firewalls. They decide reachability, not ports.