Transit VPC Solution - Building a Scalable and Secure Multi-VPC AWS Network Infrastructure

Transit VPC Solution

Transit VPCs can solve some of the shortcomings of VPC peering by introducing a hub and spoke design for inter-VPC connectivity. In a transit VPC network, one central VPC (the hub VPC) connects with every other VPC (spoke VPC) through a VPN connection typically leveraging BGP over IPsec. The central VPC contains EC2 instances running software appliances that route incoming traffic to their destinations using the VPN overlay (Figure 3). Transit VPC peering has the following advantages:

  • Transitive routing is enabled using the overlay VPN network — allowing for a simpler hub and spoke design.

  • When using 3rd party vendor software on the EC2 instance in the hub transit VPC, vendor functionality around advanced security (layer 7 firewall/IPS/IDS) can be leveraged. If customers are using the same software on-premises, they benefit from a unified operational/monitoring experience.

Figure 3 – Transit VPC with Cisco CSRs

Transit VPC comes with its own challenges, such as higher costs for running virtual appliances, limited throughput per VPC (up to 1.25 Gbps per VPN tunnel), and additional configuration and management overhead (customers have to manage the availability and redundancy of EC2 instances).