> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Centralized Security Hub VPC (Early Access)
> Deploy Aviatrix DCF gateways behind an AWS Gateway Load Balancer in a dedicated security hub VPC to enforce firewall policy across hub-and-spoke networks connected to a user-managed AWS Transit Gateway.
Centralized Security Hub VPC is **Early Access** in 9.0 and is **API-only** in
this release. There is no CoPilot UI for creating or managing a security hub
VPC. To request Early Access, contact your Aviatrix account team.
Enterprises running hub-and-spoke networks on AWS route internet-bound and
east-west traffic through a centralized security hub VPC connected to an AWS
Transit Gateway (TGW). The Centralized Security Hub VPC deploys Aviatrix
Distributed Cloud Firewall (DCF) gateways into a dedicated VPC behind an AWS
Gateway Load Balancer (GWLB), integrating directly with your existing
user-managed TGW. This enables DCF policy enforcement without Aviatrix-managed
transit gateways, reducing TGW data processing charges, inter-AZ transfer fees,
and operational complexity.
Aviatrix creates and manages all security hub VPC infrastructure: subnets, route
tables, GWLB, GWLB endpoints (GWLBEs), internet gateway, and DCF gateways. You
retain full ownership of your TGW and its route tables.
## Prerequisites
* Aviatrix Controller 9.0 or later.
* Gateway software 9.0 or later.
* An AWS account onboarded to the Aviatrix Controller with IAM permissions to
create VPCs, subnets, route tables, internet gateways, Gateway Load Balancers,
GWLB endpoints, VPC endpoint services, and EC2 instances.
* An existing user-managed AWS Transit Gateway with available attachment
capacity.
* Sufficient AWS service quotas for the target region. A 3-zone hub creates 12
subnets, 5 route tables, 3 gateways, 1 internet gateway, 3 GWLB endpoints, 1
Gateway Load Balancer, 1 VPC endpoint service, and 1 target group.
## How It Works
### Traffic Path
**Egress (internet-bound):**
Spoke workload → TGW → security hub VPC TGW attachment subnet →
GWLBE → GWLB → DCF gateway (policy evaluation) → SNAT →
internet
**East-west (RFC 1918):**
Spoke workload → TGW → security hub VPC → DCF gateway (policy
evaluation, no NAT) → TGW → destination spoke VPC
Internet-bound traffic is subject to SNAT. East-west traffic between spoke VPCs
is inspected and returned directly to workloads through the TGW without NAT.
### Infrastructure Created Per Deployment
For each Availability Zone you select, Aviatrix creates four subnets:
| Subnet | Purpose |
| --------------------- | ----------------------------------------------------------------------------------------------------------- |
| TGW attachment subnet | Hosts TGW ENIs. Default route points to the GWLBE in the same zone. |
| GWLBE subnet | Hosts the Gateway Load Balancer endpoint. |
| GWLB pool subnet | Hosts GWLB ENIs and the DCF gateway internal interface. Default route points to the TGW for return traffic. |
| Public subnet | Hosts the DCF gateway external interface. Default route points to the internet gateway. |
Aviatrix also creates one internet gateway, one Gateway Load Balancer (with
cross-zone mode enabled), one VPC endpoint service, and one target group per
deployment. GWLB cross-zone mode ensures symmetric session handling across three
or more Availability Zones.
## Configure TGW Route Tables
Aviatrix does not modify your TGW route tables. After the security hub VPC is
provisioned, configure TGW routing manually to direct workload traffic to the
security hub VPC.
In each workload VPC subnet route table, add a default route (`0.0.0.0/0`) pointing to the TGW attachment ENI.
In the TGW route table associated with workload VPCs, add:
* A default route (`0.0.0.0/0`) pointing to the security hub VPC TGW attachment (static route).
* Propagated routes for each workload VPC CIDR pointing to their respective TGW attachments.
**Example egress TGW route table after configuration:**
| Destination | Target | Type |
| ------------- | --------------------------- | ---------- |
| `10.1.0.0/16` | Workload VPC-A attachment | Propagated |
| `10.2.0.0/16` | Workload VPC-B attachment | Propagated |
| `10.3.0.0/16` | Workload VPC-C attachment | Propagated |
| `0.0.0.0/0` | Security hub VPC attachment | Static |
The security hub VPC's internal route tables (TGW attachment subnets, GWLB
pool subnets, and public subnets) are pre-configured by Aviatrix and do not
require manual changes.
## Limitations
* **Early Access and API-only**: Security hub VPCs are created, modified, and
deleted through the Aviatrix API in 9.0. No CoPilot UI is available in this
release.
* **AWS only**: Azure and GCP are not supported in this release.
* **User-managed TGW route tables**: Aviatrix does not configure TGW route
tables. You configure routing manually after the security hub VPC is
provisioned.
* **Greenfield VPC only**: The security hub VPC is provisioned by Aviatrix and
cannot reuse an existing VPC that already contains third-party appliances.
* **Cross-AZ traffic charges**: GWLB cross-zone mode ensures symmetric session
routing but may result in cross-AZ data transfer charges.
* **High AWS resource consumption**: Confirm sufficient AWS service quotas
before deployment. See the prerequisites above for resource counts.
## Related Topics
* DCF Overview
* DCF Policies and Rules