Transit Gateway attachmet

For the North-South inspection TGW is mandatory, see below section from this blog

North-South: Centralized on-premises egress & ingress via Transit Gateway and Transit VIF/Direct Connect gateway/AWS Site-to-Site VPN

Let’s expand the previous model and add inspection for North-South traffic between AWS VPC and on-premises via AWS Transit Gateway. AWS Transit Gateway can connect to your on-premises via AWS Direct Connect or via AWS Site-to-Site VPN.

A key requirement for this model is to connect AWS Direct Connect using Transit VIF to AWS Transit Gateway. In case of VPN to on-premises, AWS Site-to-Site VPN can also be used and must be established to AWS Transit Gateway as per Figure 9.