Home / AWS

AWSHow-toIntermediate

AWS network foundation: VPC design, Transit Gateway and centralised egress

Plan non-overlapping CIDRs with IPAM, build multi-AZ VPCs, connect them through Transit Gateway with route table segmentation, and centralise internet egress and DNS.

Deepak Bhardwaj2 min read

Applies toAmazon VPC, AWS Transit Gateway, VPC IPAM, Route 53 Resolver, AWS RAM

1. IP address plan with IPAM

aws ec2 create-ipam --operating-regions RegionName=ap-south-1 RegionName=ap-south-2

Create pools per region and environment (for example 10.0.0.0/12 for ap-south-1 prod, 10.16.0.0/12 for ap-south-2). Workload VPCs request CIDRs from the pool, so overlaps can't happen, including with the DR region.

2. Standard workload VPC

  • Three AZs, with subnets per tier: public (only if needed), private-app, private-data.
  • No internet gateway in most workload VPCs; egress goes through a central egress VPC.
  • VPC endpoints (gateway endpoints for S3 and DynamoDB are free) to keep AWS API traffic private.
  • Flow logs to the Log Archive account.

3. Transit Gateway

           ┌────────── TGW (shared via RAM) ──────────┐
   prod-vpc-a   prod-vpc-b   nonprod-vpc   egress-vpc   inspection-vpc   VPN/DX
  • Enable appliance mode on the inspection VPC attachment if you route through stateful firewalls across AZs.
  • Use separate TGW route tables: prod, nonprod, shared. Prod and nonprod don't propagate into each other.
  • Turn off default association/propagation and set them explicitly, so new attachments don't get full connectivity by accident.
aws ec2 create-transit-gateway --description "core-tgw" \
  --options DefaultRouteTableAssociation=disable,DefaultRouteTablePropagation=disable,AutoAcceptSharedAttachments=enable

4. Centralised egress

Egress VPC with NAT gateways in each AZ (and optionally AWS Network Firewall). Workload VPC default route 0.0.0.0/0 → TGW, TGW route to the egress VPC. One NAT gateway per AZ avoids cross-AZ dependencies and charges.

5. Hybrid DNS

  • Route 53 Resolver inbound endpoints (on-premises → AWS private zones) and outbound endpoints with forwarding rules (AWS → on-premises domains), in the shared services VPC.
  • Share resolver rules with workload accounts using RAM.
  • Associate private hosted zones with the VPCs that need them (cross-account association by authorisation).

6. HA and DR

  • Every component spans at least two AZs (TGW attachments in each AZ subnet, NAT per AZ, resolver endpoints in two AZs).
  • Build the same layout in the DR region and peer the Transit Gateways (inter-region peering, static routes).
  • Site-to-Site VPN: two tunnels per connection, and two customer gateways where possible. Direct Connect: two connections at two locations for resilient designs.

Tip

Draw the route tables, not only the boxes. Most "can't reach" tickets in TGW designs come from a missing propagation or a blackhole route, visible immediately in a route table diagram.

Related fixes