Hub & Spoke architecture with AWS Control Tower

Question

Can anyone help with any refrence architecture of hub and spoke architecture implementation (network account with TGW) on AWS Control Tower?

Accepted Answer

Hi,

This [blog](https://aws.amazon.com/blogs/mt/scale-multi-account-architecture-aws-network-firewall-and-aws-control-tower/) discusses similar architecture with TGW + Centralized Networking account and Control Tower.

This [whitepaper](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html) has reference architectures for TGW hub & spoke deployment.

You can explore the [TGW workshop](https://controltower.aws-management.tools/networking/tgw/tgw-simple/)

Hub & Spoke architecture with AWS Control Tower

Relevant questions

Hub & Spoke architecture with AWS Control Tower

Two accounts are being shown as both enrolled in one view and not enrolled in another. Why?

Does AWS Control Tower have integrations with the AWS VPC IPAM service?

Enabling AWS Configuration on Control Tower Main Account

Control Tower - Unable to add new account to the Security OU?

Best practices to deploy GuardDuty, Macie, Sec Hub and Config in a Multi-account environment?

Control Tower / Account Factory / Email Validation

AWS Control Tower - Deployment Error

Error about AWS Config in Master Account after setting up Control Tower and SecurityHub

Security Hub Master Invites Not Received