Question

A company runs 12 VPCs across a single AWS Region, all attached to a Transit Gateway. To reduce cost and management overhead, the networking team deployed a single 'egress' VPC containing a NAT gateway and an internet gateway, and they want all private subnets in the 12 spoke VPCs to reach the internet through this shared egress VPC. Instances in the spoke VPCs currently cannot reach the internet. The Transit Gateway attachments and association/propagation appear correct. Which additional configuration is required to make centralized internet egress work?

Accepted Answer

In each spoke VPC's private subnet route table, add a default route (0.0.0.0/0) pointing to the Transit Gateway; in the egress VPC, add a Transit Gateway route table static route for the spoke CIDRs and route 0.0.0.0/0 to the NAT gateway.

Answer

Enable VPC peering between each spoke VPC and the egress VPC in addition to the Transit Gateway attachments.

Answer

Attach an internet gateway to each of the 12 spoke VPCs and add a 0.0.0.0/0 route to it in the private subnets.

Answer

Enable appliance mode on the spoke VPC attachments and add the NAT gateway to each spoke VPC's route table.