Natnael Mengesha

Network Foundation, $32M Program

Segmented VPCs on a Transit Gateway hub. Centralized inspection and egress. Built into the landing zone.

Transit Gateway · VPC segmentation · Centralized egress · Landing zone · NIST 800-53

$32M
program on the network
0
spoke internet gateways
NIST
SP 800-53 alignment
WORKLOAD ACCOUNTS Prod workloads spoke VPC Stage workloads spoke VPC Dev workloads spoke VPC NETWORK ACCOUNT Transit Gateway AWS Transit Gateway Segmented routes TGW route tables INSPECTION VPC Inspection traffic inspection NAT egress NAT Gateway Internet gateway sole exit path attach attach attach segmentation all flows inspected sole egress
Fig. 1 — Spoke VPCs reach the internet only through the inspected hub egress path.

solid = account · long dash = VPC · short dash = zone or planned

Context

  • $32M program; multiple workload teams; one shared network fabric.
  • Isolation, inspection, and egress control required before first deploy.
  • Had to integrate with the existing landing zone, not sit beside it.

Decision

  • Hub-and-spoke: every workload VPC attaches to one Transit Gateway.
  • TGW route tables enforce segmentation; spokes never talk directly.
  • All outbound traffic hairpins through a central inspection VPC.
  • Single egress path; no spoke owns an internet gateway.

Outcome

  • Foundation carries the $32M program; teams deploy inside the guardrails.
  • One inspection point; one egress; NIST-aligned security baselines by default.
  • New spokes attach through the vended landing-zone pattern.