You can use a transit VPC not only to provide direct network routing between VPCs and on-premises networks, but also to implement more complex routing rules such as network address translation between overlapping network ranges, or to add additional network-level packet filtering or inspection. However, this approach requires you to configure and manage the EC2-based VPN instances deployed in the transit VPC. We highly recommend using virtual network appliances available in the AWS Marketplace to significantly reduce the level of effort to establish and maintain these VPN connections. As with the previous approach, network traffic is routed over the AWS global network backbone by default, but will fail over to AWS ISP networks in the unlikely event that AWS private network infrastructure is unavailable. This design will result in additional EC2 and, potentially, third-party license charges. Also, be aware that this design will generate additional data-transfer charges for traffic traversing the transit VPC: data is charged when it is sent from a spoke VPC to the transit VPC, and again from the transit VPC to the on-premises network.

For recommended products, search AWS Marketplace for one the following terms: Aviatrix, Cisco CSR 1000V, Fortinet FortiGate, Palo Alto Networks, Sophos UTM, Vyatta.