- Newest
- Most votes
- Most comments
For an individual vendor, you could create a separate transit gateway route table containing routes only for the destination VPCs and on-premises networks you want the vendor to be able to reach. Then associate that route table with the vendor's transit gateway attachment. This will prevent them from sending traffic to other destinations through your TGW, regardless of which route tables your own VPCs and on-premises networks use.
Note, however, that this won't prevent your own VPCs or on-premises networks from sending packets unidirectionally towards the vendor, although they wouldn't be able to respond due to the routes being missing in the return direction. This approach also won't scale to many vendors, since a TGW can only have a total of 20 route tables.
If you want to control the vendor's traffic fully, you should place a proper firewall, such as AWS Network Firewall or a third-party solution, between their network and your internal networks routed via your TGW. The TGW by itself isn't a firewall but a very high-throughput router.
Relevant content
asked 4 years ago
Thanks for your input! If I create a separate Transit Gateway route table (let's say Route Table B) that contains routes only for the destination VPCs and on-premises networks, Currently, my Direct Connect Gateway (DXGW) attachments from on-prem are associated with my main route table (Route Table A). Since DX Gateway attachments can only be associated with one route table (in this case, RTB A), would I need to set up a static route for on-prem using the DX Gateway attachment in RTB B?
Example: My Transit Gateway Route Table (RTB) will include the following associations: 1.Vendor's TGW attachment 2.My own VPC 3.Static routes for on-premises networks, using the DX Gateway attachment
Please advise.
If you want the vendor to be able to communicate with your on-prem networks, then yes, you are correct: the route table B associated with the vendor's TGW attachment must contain a route towards the DXGW attachment, and additionally, route table A used for all other attachments (including the DXGW one) must contain a route towards the vendor's TGW attachment.