To get traffic from on-premises resources to AWS EC2, we can use VPN connections or AWS Direct Connect.
For VPN connections from on-premises gateways connect to the TGW as a VPN attachment.
Multiple tunnels and ECMP provide resiliency.
AWS TGW Reference Architectures for Multi-VPC - 4/5 - East-West Traffic
East-west traffic, or traffic between VPCs, flows through the NGFW in the security VPC.
3. AWS TGW Reference Architectures for Multi-VPC - 3/5 - Outbound Traffic
This design uses overlay routing for outbound security on the NGFW.
Outbound traffic from EC2 in the WEB VPCs traverses the TGW and egresses the AWS environment through the NGFW.
2. AWS TGW Reference Architectures for Multi-VPC - 2/5 - Inbound Traffic
Inbound traffic originates outside the VPC, such as the Internet, and is destined to applications or services hosted within your VPCs, such as web servers.
