Hub & Spoke architecture with AWS Control Tower

Question

Can anyone help with any refrence architecture of hub and spoke architecture implementation (network account with TGW) on AWS Control Tower?

Accepted Answer

Hi,

This [blog](https://aws.amazon.com/blogs/mt/scale-multi-account-architecture-aws-network-firewall-and-aws-control-tower/) discusses similar architecture with TGW + Centralized Networking account and Control Tower.

This [whitepaper](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html) has reference architectures for TGW hub & spoke deployment.

You can explore the [TGW workshop](https://controltower.aws-management.tools/networking/tgw/tgw-simple/)

Hub & Spoke architecture with AWS Control Tower

Relevant questions

Control Tower - Unable to add new account to the Security OU?

Enabling AWS Configuration on Control Tower Main Account

Does AWS Control Tower have integrations with the AWS VPC IPAM service?

Two accounts are being shown as both enrolled in one view and not enrolled in another. Why?

Hub & Spoke architecture with AWS Control Tower

Error about AWS Config in Master Account after setting up Control Tower and SecurityHub

Security Hub Master Invites Not Received

Control Tower / Account Factory / Email Validation

Best practices to deploy GuardDuty, Macie, Sec Hub and Config in a Multi-account environment?

AWS Control Tower - Deployment Error