Transit Gateway + Firewall

Transit Gateway + AWS Network Firewall

Purpose

Runbook for AWS Network Firewall designs, especially centralized inspection with Transit Gateway and VPC route tables.

Related Pages

• Amazon VPC Lattice
• Operations sandbox

Checklist

• [ ] Confirm firewall endpoints exist in every inspected AZ.
• [ ] Check route tables: traffic must route through the correct firewall endpoint or TGW attachment.
• [ ] Enable flow and alert logs before incident testing.
• [ ] Validate stateless default actions and stateful rule-group order.

Verified References

Network Firewall logs to CloudWatch Logs

Network Firewall logs to S3

Network Firewall CloudWatch metrics