Transit Gateway
Network SecurityAWS Transit Gateway acts as a cloud router, connecting thousands of VPCs and on-premises networks through a single gateway. It simplifies network topology by replacing complex VPC peering meshes.
Security Features
- Route Tables: segment traffic between VPCs (e.g., isolate production from development)
- Route Table Associations: control which VPCs can communicate with each other
- Blackhole Routes: drop traffic to specific CIDRs
- Multicast Support: for specialized network patterns
- Flow Logs: Transit Gateway flow logs for network visibility
Network Segmentation Pattern
- Shared Services VPC: DNS, logging, security tools accessible by all
- Inspection VPC: route all traffic through Network Firewall or IDS/IPS appliances
- Isolated VPCs: prevent direct communication between workload VPCs
Related AWS Services
Related Terms
An isolated virtual network within AWS where you launch resources, with full control over IP addressing, subnets, route tables, and network gateways.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
A technology that provides private connectivity between VPCs, AWS services, and on-premises networks without exposing traffic to the public internet.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.