JA EN
shiichan

Transit Gateway's Routing Gets Smarter: Policy-Based Routing Is Finally Here!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#security

Hey everyone, it's Shiichan! I've got some networking news today, and I think a lot of people have been waiting for this one. AWS Transit Gateway just got a new capability I really want to tell you about!

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, AWS announced that Transit Gateway now supports Policy-Based Routing (PBR), and it's generally available (GA).

Until now, Transit Gateway's routing only looked at the destination IP address to decide where to forward traffic. With PBR, you can combine source IP address, destination IP address, port, and protocol to decide how traffic gets routed.

The story so far

Since routing only looked at the destination IP address, if you wanted to steer traffic based on other conditions or isolate workloads, you had no choice but to build architectures with multiple VPCs and extra routing hops. That made the setup more complex and added operational overhead.

What changes

PBR extends Transit Gateway's native routing capabilities, so you can classify and direct traffic inline without building any extra infrastructure.

For security architects and enterprise network teams, this means you can get the routing control you need while keeping your architecture simple, which is a really welcome change.

Dive Deep

Here's how PBR works.

  • You associate a policy table with a Transit Gateway attachment
  • The policy table holds an ordered set of rules
  • Each rule classifies traffic and forwards matching packets to a specified route table, using first-match-wins logic

AWS also shared some use cases for PBR.

  • Steering sensitive workloads through AWS Network Firewall or a third-party inspection appliance
  • Routing application traffic over AWS Direct Connect or AWS VPN paths based on source, port, or protocol
  • Separating production and development environments into distinct routing domains to limit lateral movement

And here's the availability, configuration, and pricing.

  • PBR is available in every commercial AWS Region where Transit Gateway is available
  • You can configure it from the AWS Management Console, the AWS CLI, or the AWS SDK
  • There's no additional charge for PBR itself, you just pay standard Transit Gateway fees

Wrap-up

  • Transit Gateway routing can now look at source IP, port, and protocol, not just destination IP
  • Policy tables with ordered rules let you build firewall steering or environment isolation without extra infrastructure
  • It's available everywhere Transit Gateway is available, with no extra charge

If you're on a security or network team that's been juggling complex multi-VPC setups just to steer traffic, this update is for you!

Related posts