Building a Secure Multi-VPC Architecture with AWS Transit Gateway and Internet Gateway

Introduction:

Modern cloud environments result in organizations deploying multiple Virtual Private Clouds to segregate workloads, achieve scale, and implement security boundaries based on business units or application tiers. However, when establishments invest in hundreds of VPCs, it’s a heavy chore to manage connectivity and secure internet access. AWS Transit Gateway resolves this problem by serving as a highly scalable hub for integrating all VPCs in a centralized architecture. This allows case enterprises to implement a secure integrated VPC layout by seamlessly linking Internet Gateways (IGWs) to it. Hence, they can establish an affordable, secure, and scalable design accommodating both east-west and north-south traffic flow. The resultant architecture ensures a homogenized network segment with a route, security control and monitoring, while ensuring velocity, performance, and uniformity with an enterprise’s hardening standard. Basically, multi-VPC secure design using AWS Transit Gateway in combination with the IGW is an excellent approach for organizations to maintain the right balance in the cloud between flexibility, velocity, and protection.

On an AWS cloud Proof of Concept, the Transit Gateway and Internet Gateway are essential to securely, scalable and efficiently enable communication between the VPCs and external networks. 

Role of Transit Gateway:

The Transit Gateway acts as a central routing hub where multiple VPCs can talk without having to create multiple VPC peering connections. It reduces the complexity of network management and scales and allows for security policies to be enforced by utilizing route tables that function as a firewall to control the flow of traffic between connected VPCs. 

Role of Internet Gateway:

The Internet Gateway is necessary for resources on the public subnet to access the internet either outbound or inbound. This necessitates the use of IGW, public facing resources such as web servers and APIs will be able to talk to external services while private resources are only enabled for outbound communication through NAT Gateways. 

The integration of TGW and IGW provides a well-structured and controlled networking environment such that mission-critical workloads are safe, isolated when required and enabled to communicate efficiently.

Let’s understand using one POC-- 

POC 

The proposed Proof of Concept (PoC) focuses on establishing secure and controlled communication between multiple VPCs using AWS Transit Gateway (TGW) and Internet Gateway (IGW) in the US-EAST-1 region. The architecture consists of three VPCs: GTPL_NOC (10.1.1.0/24), GTPL_SOC (10.1.2.0/24), and GTPL_ADM (10.1.3.0/24), with TGW (GTPL_TGW_US-EAST-1) acting as the central routing hub. GTPL_NOC and GTPL_ADM are connected via TGW, enabling seamless communication, while GTPL_SOC remains isolated with no TGW attachment to enforce strict security policies. An Internet Gateway (GTPL_IGW_US-EAST-1) is attached to GTPL_NOC to facilitate external connectivity, allowing public-facing resources in the GTPL_NOC Public Subnet (10.1.1.0/28) to access the internet. Private subnets in GTPL_ADM (10.1.3.0/28) can leverage a NAT Gateway in GTPL_NOC for outbound internet access without exposing internal resources. By implementing TGW route tables and security policies, the setup ensures efficient inter-VPC communication while maintaining strict isolation for GTPL_SOC. This PoC serves as a scalable network foundation, enabling controlled access to internet services while securing sensitive workloads in a multi-VPC environment.

Implementation steps of POC

Step-2: Create VPC for GTPL_SOC

Step-3: Create VPC for GTPL_ADMIN

Step-4: Create transit Gateway of GTPL_TGW

Step-5: Create Public subnet for GTPL_NOC 

Step-6: Create Public subnet for GTPL_SOC

Step-7: Create Private subnet for GTPL_ADMIN

Step-8 Attach GTPL_NOC_VPC with TGW

Step-9 Attach GTPL_ADMIN_VPC with TGW

STEP-10 create security group with inbound and outbound traffic rule of GTPL_NOC 

STEP-11 Associate GTPL_NOC Security Group with GTPL_ADMIN_VPC

STEP-12 Create VM /EC2 instance for GTPL_NOC

STEP-13 Create GTPL_NOC_IGW for outbound traffic towards internet

STEP-14 Select GTPL_NOC VPC and attached with GTPL_NOC_IGW

Step-15 Associate GTPL_NOC_VPC with GTPL_ADMIN_SG

wrap-up: 

Note:

1. Previous all steps need to be followed from Admin department towards NOC department except IGW.

2. Here, SOC department remains isolated.

3. As per requirement wise need to apply Inbound and outbound traffic policy then create security group appropriately.

4. As per Policy and POC wise VPC need to attach with security group.

5. Virtual Machine/workload/EC2 instance need to attach with VPC.

6. with the help of ICMP reachability we can cross-verify architecture wise POC.