Transit Gateway Hub Stack

Hub-and-Spoke Networking Done Right

As your AWS footprint grows past one or two VPCs, peering connections become unmanageable. Transit Gateway is the answer — and this CloudFormation stack gives you the hub-and-spoke pattern with route table isolation so your production, staging, and dev environments can't accidentally talk to each other.

What's Deployed

• Central Transit Gateway with Amazon-side ASN configured
• Separate route tables for Prod, Non-Prod, and Shared Services
• Spoke VPC attachment template (parameterized, reusable per VPC)
• Route propagation rules enforcing environment isolation
• DNS resolution enabled across attachments

Environment Isolation Model

Production spoke can reach Shared Services (CIDR 10.0.0.0/16). Non-prod spokes reach each other and Shared Services. Production and Non-Prod are explicitly blackholed from each other.

Included Files

• tgw-hub.yaml — Transit Gateway and route tables
• tgw-spoke-attachment.yaml — reusable spoke attachment template
• parameters/ — example parameters for prod, staging, dev
• README.md — CIDR planning guide and attachment walkthrough