Hub and Spoke Transit Gateway Stack

Hub and Spoke Networking via AWS Transit Gateway

A production-ready CloudFormation stack that builds a full hub-and-spoke network topology using AWS Transit Gateway — shared services VPC at the center, isolated route tables per environment, and an inspection VPC slot pre-wired for future firewall insertion.

What's Included

• Transit Gateway with ECMP support and auto-accept shared attachments disabled
• Shared services VPC attachment and propagation rules
• Workload VPC attachments (dev, staging, prod) with isolated route tables per environment
• Inspection VPC slot pre-wired — drop in Network Firewall or a third-party appliance
• Blackhole routes to prevent cross-environment lateral movement
• Resource Access Manager (RAM) sharing config for multi-account deployments

What You Get

• transit-gateway.yaml — main CloudFormation template
• workload-vpc-attachment.yaml — reusable attachment template per workload VPC
• parameters/ — parameter files for dev, staging, and prod environments
• .env.example — account IDs, region, and naming prefixes
• README.md — architecture diagram reference, deployment order, and RAM sharing guide

Requirements

• AWS account with CloudFormation and EC2:TransitGateway permissions
• Existing VPCs to attach (or use the included parameter files as a starting point)
• For multi-account RAM sharing: AWS Organizations or manual principal ARNs