Lab: Designing Multi-Account Connectivity with AWS Transit Gateway

In this lab, you will implement a hub-and-spoke networking architecture across multiple AWS accounts and regions. You will use AWS Transit Gateway (TGW) and AWS Resource Access Manager (RAM) to centralize connectivity and manage routing between disparate VPCs.

Prerequisites

• Two AWS Accounts: Referred to as Account-A (Hub) and Account-B (Spoke).
• AWS CLI: Installed and configured with profiles for both accounts (--profile account-a and --profile account-b).
• IAM Permissions: AdministratorAccess or a custom policy allowing ec2:*TransitGateway*, ram:*, and ec2:*Vpc* actions.
• Network Planning:
  • Hub VPC CIDR: 10.0.0.0/16 (Region: us-east-1)
  • Spoke VPC CIDR: 10.1.0.0/16 (Region: us-east-1)

Learning Objectives

• Provision an AWS Transit Gateway in a central hub account.
• Share network resources across accounts using AWS Resource Access Manager (RAM).
• Configure Transit Gateway Attachments for cross-account VPCs.
• Implement a routing strategy that allows communication between spoke and hub networks.

Architecture Overview

This architecture uses a Transit Gateway as a virtual router to manage traffic between VPCs. By sharing the TGW via RAM, the Spoke account can attach its VPC without needing its own gateway, reducing management overhead.

Step-by-Step Instructions

Step 1: Create the Transit Gateway (Account A)

The Transit Gateway acts as the central hub. We will disable "Default Route Table Propagation" for this lab to learn manual routing, though in production, you might enable it for simplicity.

[!TIP] Note the TransitGatewayId from the output; you will need it for all subsequent steps.

▶Console Alternative

Navigate to VPC Dashboard > Transit Gateways > Create Transit Gateway. Set Name to 'Hub-TGW' and ensure 'Auto accept shared attachments' is enabled.

Step 2: Share the TGW via AWS RAM (Account A)

To allow Account B to see the TGW, you must share it using Resource Access Manager.

Step 3: Accept the Resource Share (Account B)

In Account B, you must accept the invitation to use the shared TGW.

Step 4: Create VPC Attachments

Now, attach both VPCs to the TGW. Note that the Hub attachment is done in Account A, and the Spoke attachment is done in Account B.

In Account A:

In Account B:

Step 5: Configure Routing Tables

You must update the VPC Route Tables (not just the TGW route table) to point traffic to the TGW.

In Account A (Hub VPC Route Table):

• Destination: 10.1.0.0/16 (Spoke)
• Target: tgw-<ID>

In Account B (Spoke VPC Route Table):

• Destination: 10.0.0.0/16 (Hub)
• Target: tgw-<ID>

Checkpoints

Teardown

[!WARNING] Fail to delete these resources will result in hourly charges for the Transit Gateway and its attachments.

1. Delete TGW Attachments: Start with Account B, then Account A.
   • aws ec2 delete-transit-gateway-vpc-attachment --transit-gateway-attachment-id <ID>
2. Delete Resource Share: In Account A RAM console/CLI.
3. Delete Transit Gateway: In Account A.
   • aws ec2 delete-transit-gateway --transit-gateway-id <ID>

Troubleshooting

Stretch Challenge

Task: Implement a "Security VPC" pattern. Create a third VPC (10.2.0.0/16) and configure the TGW Route Table so that all traffic between the Hub and Spoke must first pass through the Security VPC (using it as a Next Hop). This simulates an Inline Inspection pattern with a Firewall appliance.

Cost Estimate

• Transit Gateway: ~$0.05 per attachment per hour.
• Data Processing: ~$0.02 per GB processed by the TGW.
• Estimated Lab Cost: < $1.00 (if completed within 60 minutes).

Concept Review

Why use Transit Gateway over VPC Peering?

Theoretical Routing Logic

\begin{tikzpicture}[node distance=2cm, every node/.style={rectangle, draw, minimum width=2.5cm, minimum height=1cm, align=center}] \node (start) {Packet Source$10.0.0.5)}; \node (vpcrt) [right=of start] {VPC Route Table$Match 10.1.0.0/16)}; \node (tgw) [right=of vpcrt] {Transit Gateway$Lookup Route Table)}; \node (dest) [right=of tgw] {Packet Destination$10.1.0.20)};

\draw[->] (start) -- (vpcrt); \draw[->] (vpcrt) -- node[above] {Target: TGW} (tgw); \draw[->] (tgw) -- node[above] {Attachment B} (dest); \end{tikzpicture}