NACL for separate subnet attached to transit gateway

Question

regarding the following documentation page for NACL to subnets attached to transit gateway: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nacls.html

the page suggest best practice to add a separate subnet with /28 CIDR for example and attach it to transit gateway with no work load and the page recommend to not configure its  inbound and outbound NACL which mainly control traffic to/from the transit gateway itself and only use the other subnet with work load inbound and outbound NACL when there are 2 subnets one attached to TGW and the other with work load are not attached!

when I look to above situation, I see AWS ask for configuring additional subnet and attach it to TGW without workload to use it to control traffic to/from TGW with NACL then recommend not to use these NACLs and keep configuring the workload subnet NACL just as the 1st situation where the workload subnet is the only one attached to TGW.

my question here is, if I understand the page correctly, AWS asks to use more resources/configuration and recommend not to use it, so why should we go/use  this case ?

I will be more than happy, if the page said, you can use the inbound/outbound NACL of the subnet attached to the transit gateway (in the 2 subnet scenario ) to centrally control traffic to/from the transit gateway which I think it will be a big step forward in centrally securing traffic of a VPC attached to TGW

Best Regards,
Ahmed

re:Post Agent · Answer

You've raised a good question about the AWS Transit Gateway subnet recommendations. Let me clarify the reasoning behind this best practice.

The recommendation to use a separate subnet for each transit gateway VPC attachment (with a small CIDR like /28) serves several important purposes, even though it appears to add complexity:

1. **Separation of concerns**: By isolating the transit gateway attachment in its own subnet, you create a clear boundary between transit infrastructure and workloads. This makes network management and troubleshooting easier.

2. **Resource allocation control**: Using a dedicated subnet prevents workload resources from being deployed in the same subnet as your transit gateway attachment. You can even use subnet CIDR reservations to explicitly prevent EC2 instances or other resources from being allocated in this subnet.

3. **Security posture**: While the recommendation is to keep NACLs open on the transit gateway subnet, this is specifically for the transit gateway traffic to flow properly. The workload subnets can have more restrictive NACLs applied based on your specific security requirements.

4. **Operational clarity**: Having dedicated transit gateway subnets makes it easier to understand traffic flows and apply consistent networking policies across your organization.

The recommendation isn't suggesting you configure but not use NACLs. Rather, it's advising that the transit gateway subnet should have open NACLs to allow transit traffic to flow freely, while you apply your security controls at the workload subnet level where they're more effective and won't interfere with the transit gateway's operation.

This approach follows the AWS best practice of using purpose-built subnets for infrastructure components, similar to how you might use dedicated subnets for NAT gateways or load balancers.  
**Sources**  
[Network ACLs for transit gateways in AWS Transit Gateway - Amazon VPC](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nacls.html)  
[How can I restrict the allocation of resources in the subnet assigned to the VPC attachment transit gateway? | AWS re:Post](https://repost.aws/questions/QUHJm8t6ltS_6Emtns5S90fg/how-can-i-restrict-the-allocation-of-resources-in-the-subnet-assigned-to-the-vpc-attachment-transit-gateway)  
[AWS Transit Gateway design best practices - Amazon VPC](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-best-design-practices.html)  
[Preserve routable IP space in multi-account VPC designs for non-workload subnets - AWS Prescriptive Guidance](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/preserve-routable-ip-space-in-multi-account-vpc-designs-for-non-workload-subnets.html)  
[Control subnet traffic with network access control lists - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html)

NACL for separate subnet attached to transit gateway

Add your answer

Relevant content