Skip to main content
Centralized Security Hub VPC is Early Access in 9.0 and is API-only in this release. There is no CoPilot UI for creating or managing a security hub VPC. To request Early Access, contact your Aviatrix account team.
Enterprises running hub-and-spoke networks on AWS route internet-bound and east-west traffic through a centralized security hub VPC connected to an AWS Transit Gateway (TGW). The Centralized Security Hub VPC deploys Aviatrix Distributed Cloud Firewall (DCF) gateways into a dedicated VPC behind an AWS Gateway Load Balancer (GWLB), integrating directly with your existing user-managed TGW. This enables DCF policy enforcement without Aviatrix-managed transit gateways, reducing TGW data processing charges, inter-AZ transfer fees, and operational complexity. Aviatrix creates and manages all security hub VPC infrastructure: subnets, route tables, GWLB, GWLB endpoints (GWLBEs), internet gateway, and DCF gateways. You retain full ownership of your TGW and its route tables.

​
Prerequisites

  • Aviatrix Controller 9.0 or later.
  • Gateway software 9.0 or later.
  • An AWS account onboarded to the Aviatrix Controller with IAM permissions to create VPCs, subnets, route tables, internet gateways, Gateway Load Balancers, GWLB endpoints, VPC endpoint services, and EC2 instances.
  • An existing user-managed AWS Transit Gateway with available attachment capacity.
  • Sufficient AWS service quotas for the target region. A 3-zone hub creates 12 subnets, 5 route tables, 3 gateways, 1 internet gateway, 3 GWLB endpoints, 1 Gateway Load Balancer, 1 VPC endpoint service, and 1 target group.

​
How It Works

​
Traffic Path

Egress (internet-bound): Spoke workload → TGW → security hub VPC TGW attachment subnet → GWLBE → GWLB → DCF gateway (policy evaluation) → SNAT → internet East-west (RFC 1918): Spoke workload → TGW → security hub VPC → DCF gateway (policy evaluation, no NAT) → TGW → destination spoke VPC Internet-bound traffic is subject to SNAT. East-west traffic between spoke VPCs is inspected and returned directly to workloads through the TGW without NAT.

​
Infrastructure Created Per Deployment

For each Availability Zone you select, Aviatrix creates four subnets: Aviatrix also creates one internet gateway, one Gateway Load Balancer (with cross-zone mode enabled), one VPC endpoint service, and one target group per deployment. GWLB cross-zone mode ensures symmetric session handling across three or more Availability Zones.

​
Configure TGW Route Tables

Aviatrix does not modify your TGW route tables. After the security hub VPC is provisioned, configure TGW routing manually to direct workload traffic to the security hub VPC.
1

Update workload VPC subnet route tables

In each workload VPC subnet route table, add a default route (0.0.0.0/0) pointing to the TGW attachment ENI.
2

Update the TGW egress route table

In the TGW route table associated with workload VPCs, add:
  • A default route (0.0.0.0/0) pointing to the security hub VPC TGW attachment (static route).
  • Propagated routes for each workload VPC CIDR pointing to their respective TGW attachments.
Example egress TGW route table after configuration:
The security hub VPC’s internal route tables (TGW attachment subnets, GWLB pool subnets, and public subnets) are pre-configured by Aviatrix and do not require manual changes.

​
Limitations

  • Early Access and API-only: Security hub VPCs are created, modified, and deleted through the Aviatrix API in 9.0. No CoPilot UI is available in this release.
  • AWS only: Azure and GCP are not supported in this release.
  • User-managed TGW route tables: Aviatrix does not configure TGW route tables. You configure routing manually after the security hub VPC is provisioned.
  • Greenfield VPC only: The security hub VPC is provisioned by Aviatrix and cannot reuse an existing VPC that already contains third-party appliances.
  • Cross-AZ traffic charges: GWLB cross-zone mode ensures symmetric session routing but may result in cross-AZ data transfer charges.
  • High AWS resource consumption: Confirm sufficient AWS service quotas before deployment. See the prerequisites above for resource counts.