# Egress/Transit VPC Architectural Design

## **Introduction**

When designing networks in AWS, cost optimization plays a crucial role. One effective approach to reduce costs is implementing an Egress or Transit VPC architecture. This design allows us to centralize key resources within a dedicated VPC and connect other VPCs to it using either VPC Peering or a Transit Gateway.

In this article, we will explore the concept of a Transit VPC, demonstrating how multiple VPCs can be interconnected using VPC Peering. Additionally, we will highlight the role of a Squid proxy server in enabling internet access for private subnets within Spoke VPCs.

## **Transit VPC Setup and Connectivity**

The Transit VPC acts as a central hub, facilitating communication. By utilizing VPC Peering, we enable secure and efficient communication among VPCs while avoiding the complexity and cost of managing redundant resources.

To illustrate this setup, we have deployed instances across all VPCs and configured them to communicate through the Transit VPC. This setup ensures connectivity among Spoke VPC instances while leveraging the centralized architecture for enhanced efficiency.

## **Enabling Internet Access for Private Subnets**

One key challenge in a multi-VPC environment is enabling internet access for instances in private subnets. Since NAT Gateways and Internet Gateways function within their respective VPCs and do not support traffic from external VPCs, we must find an alternative solution.

To address this, we have installed Squid, an open-source proxy server, on an instance within the Transit VPC. This allows instances in Spoke VPCs to route their internet-bound traffic through the Squid proxy, effectively bypassing the NAT Gateway limitation.

## **Architecture Overview**

The following diagram represents the architectural design for this setup:

* **Egress/Transit VPC**: Hosts the Squid proxy and acts as the central point for outbound traffic.
    
* **Spoke VPCs**: Connected to the Transit VPC using VPC Peering.
    
* **Instances across VPCs**: Configured for connectivity and internet access through the Transit VPC.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743167998773/7042fc59-76df-4a1f-a58a-3ccae9729faf.png align="center")

## **Security Considerations**

To ensure secure connectivity, appropriate security group configurations have been applied:

* **Egress Spoke VPC Instance Security Group**: Defines access rules for outbound traffic.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743169787211/a7265671-732a-4321-bb93-b66e5e51dcd1.png align="center")

**Spoke 1 VPC Instance Security Group**: Enables communication with the Transit VPC.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743169754692/010c002e-d624-42db-a6ef-6fa0167b8364.png align="center")

**Spoke 2 VPC Instance Security Group**: Configured similarly for connectivity.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743169834442/bfa51473-2688-4135-a04d-6d7dbe14e57a.png align="center")

## **Connectivity Demonstration**

### **1\. Connecting to Spoke 1 VPC Instance**

A successful connection from Spoke 1 to the internet is demonstrated, confirming proper routing through the Transit VPC.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743170084650/e9b944ef-0350-4984-9819-19fc8e712ee0.png align="center")

### **2\. Connecting to Spoke 2 VPC Instance**

Similarly, Spoke 2 instances are shown to connect to the internet via the Squid proxy.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743170144114/af377a86-d26f-4e6c-ba30-c5a3664febf7.png align="center")

### **3\. Inter-Spoke VPC Communication**

Without VPC Peering configured between Spoke VPCs, instances are unable to communicate directly. This highlights the importance of establishing proper connectivity based on business requirements.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743170185698/ba37c1ab-03e2-4b83-98b4-bd2c33c20525.png align="center")

## **Conclusion**

Implementing an Egress or Transit VPC provides a cost-effective and scalable solution for managing network connectivity in AWS. By centralizing internet access through a Squid proxy and using VPC Peering or a Transit Gateway, organizations can enhance security, reduce operational overhead, and improve network efficiency.

This design ensures seamless communication while mitigating the limitations of traditional NAT and Internet Gateways in multi-VPC environments.