Creating a Transit Gateway and related resources

To create a Transit Gateway and related resources:

1. Create a Transit Gateway (TGW):
   1. In the AWS console, open the VPC service.
   2. Select Transit Gateways, then click the Create Transit Gateway button.
   3. In the Name tag field, enter the desired name.
   4. Deselect Default route table association and Default route table propagation to prevent undesired association into the security route.
   5. Edit Transit gateway CIDR blocks to enter the same CIDR range as the TGW-Subnet that you configured in Creating VPCs and subnets.

      

   6. Configure other fields as desired, then click Create.
   7. Wait for the TGW state to change from Pending to Available before proceeding.
2. Create two TGW route tables: one for the security VPC and another for the spokes:
   1. In the AWS console, open the VPC service.
   2. Select Transit Gateway Route Tables, then click the Create Transit Gateway Route Table button.
   3. In the Name tag field, enter the desired name.
   4. From the Transit Gateway ID dropdown list, select the Transit Gateway ID.
   5. Click Create.
   6. Repeat the process for the spoke route table.
3. Create three TGW attachments, one for each VPC:
   1. In the AWS console, open the VPC service.
   2. Select Transit Gateway Attachments, then click the Create Transit Gateway Attachment button.
   3. From the Transit Gateway ID dropdown list, select the Transit Gateway ID.
   4. In the Attachment type field, select VPC.
   5. In the Attachment name tag field, enter the desired name.
   6. In the VPC ID field, enter the security VPC ID for the first attachment. This is TGW_Sec_VPC_Attachment in the screenshot.
   7. For Subnet IDs, select the TGW-Subnet of each availability zone (AZ) for the security VPC.

      

   8. Repeat the process for the other two VPC IDs, spokes A and B. For the subnet VPC attachment, select the corresponding AZ for each, then the Subnet ID dropdown list shows the spoke subnet that you created.
   9. Wait for the State to become Available.

      

4. Create TGW associations:
   1. In the AWS console, open the VPC service.
   2. Select Transit Gateway Route Tables, then select the spoke route table.
   3. On the Associations tab, click the Create Association button.
   4. From the Choose attachment to associate dropdown list, select the spoke 1 VPC.
   5. Click Create association.
   6. Repeat the process for spoke B, which will be the second association for the route table.
   7. Wait for both associations to achieve the Associated state before proceeding.
   8. Next, select the security route table.
   9. Repeat the same as above to add the security VPC attachment to the security TGW route table. Click Create association.

   You should associate the security attachment using the TGW-Subnets to the security route table. The spoke attachments will be associated to the spoke route table.

5. Add routes to the security TGW route table:
   1. In the AWS console, open the VPC service.
   2. Select Transit Gateway Route Tables, then select the security route table.
   3. Add a static route for each spoke subnet and select spoke VPC attachments.
6. Add routes to the spoke TGW route table:
   1. In the AWS console, open the VPC service.
   2. Select Transit Gateway Route Tables, then select the spoke route table.
   3. Add a static route for 0.0.0.0/0 to the security VPC attachment.
   4. Add specific null routes: Spoke1(A) subnet, Spok2(B) Subnet, and SEC-Public Subnets.