jajera · tgw-policy-based-routing-walkthrough

TGW Policy-Based Routing

Published walkthrough for the jajera/tgw-policy-based-routing lab — a three-account hub-and-spoke demo that proves destination-only Transit Gateway routing versus Policy-Based Routing (same Spoke B IP, TCP/443 via Hub, TCP/80 direct).

Deploy and prove Lab repository

Three accounts

Network Hub + TGW + NAT

Owns the Transit Gateway, Hub VPC, internet egress, and the optional Hub forwarder.

CLI profile network Sandbox Spoke A client

Client VPC with the policy table on its TGW attachment — where PBR decides the path.

CLI profile sandbox Shared services Spoke B listener

HTTP :80 / HTTPS :443 on one private IP — destination IP alone cannot explain the split.

CLI profile shared-services

What this covers

The pattern. Classic transit gateway route tables forward by destination prefix only. A policy table evaluates an ordered rule set (source/destination CIDR, protocol, ports) and selects a target route table — first match wins; no match is implicit deny. Destination routing still runs inside the table PBR selects.

The lab. Terraform in jajera/tgw-policy-based-routing provisions the topology. This site is the operator walkthrough and concept docs — clone and apply the lab, then follow Deploy and prove.

Lab rule 100 matches destination TCP/443 → Steer via Hub. Rule 200 is a catch-all → Direct. Without the catch-all, :80 and ICMP drop (implicit deny).

Read in this order

1. Architecture Hub, spokes, policy vs route tables, path map 2. Policy tables Match criteria, evaluation order, system vs customer entries 3. Use cases Path selection (this lab), inspection, isolation 4. Deploy and prove Apply the lab, prove the path split, tear down Troubleshooting Failure modes, metrics, and fixes Reference CLI commands ↔ EC2 API actions

Last verified against AWS Transit Gateway documentation on 2026-08-06. Feature availability, limits, and behaviour can change — check current AWS docs before relying on any claim here.

Prerequisites in brief

Terraform >= 1.6 and AWS provider >= 5.0 (in the lab repo)
Profiles network, sandbox, and shared-services (three distinct accounts)
Session Manager plugin
Region examples: ap-southeast-2

Full detail in the walkthrough.

The lab is billable while running: TGW attachments, NAT, EC2, flow logs. Follow teardown in the walkthrough; confirm terraform state list is empty.

Next: Architecture →