View a markdown version of this page

Centralizing Amazon VPC Endpoint Access with AWS Transit Gateway - Centralizing Amazon VPC Endpoints with AWS Transit Gateway
Centralizing Amazon VPC endpoint access architectureFurther readingDiagram history

Centralizing Amazon VPC Endpoint Access with AWS Transit Gateway

Publication date: March 25, 2022 (Diagram history)

This architecture centralizes Amazon VPC interface endpoints in a shared services VPC using AWS Transit Gateway. You create custom Amazon Route 53 private hosted zones and associate them to all VPCs that consume these endpoints.

Centralizing Amazon VPC endpoint access architecture

Architecture diagram showing centralized VPC endpoint access through AWS Transit Gateway and a shared services VPC.

The following steps describe the data flow in this architecture:

  1. An Amazon Elastic Compute Cloud instance in spoke VPC A resolves the Amazon Simple Storage Service domain name by querying the VPC+2 resolver. Private hosted zone A associates with spoke VPC A to complete domain resolution.

  2. The instance sends the traffic to the Transit Gateway ENI as per the spoke VPC A route table.

  3. The traffic forwards to AWS Transit Gateway.

  4. The Transit Gateway spoke VPC route table forwards the traffic to the shared services VPC.

  5. The Transit Gateway ENI in the shared services VPC forwards the traffic to the corresponding interface endpoint connecting to Amazon S3.

The return path follows these steps:

  1. The VPC endpoint sends the response back to the Transit Gateway ENI.

  2. The traffic forwards to AWS Transit Gateway.

  3. The Transit Gateway shared services route table sends the traffic to spoke VPC A.

  4. The Transit Gateway ENI delivers the response to the destination Amazon EC2 instance.

For more information about interface endpoints and AWS PrivateLink, see Access an AWS service using an interface VPC endpoint.

To see an example of this architecture in Terraform, see AWS Hub and Spoke Architecture with Shared Services VPC.

Further reading

For additional information, see the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

March 25, 2022

Initial publication

Reference architecture diagram first published.

March 25, 2022

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.