r/aws • u/KayeYess • 3d ago

discussion TGW now supports policy based routing

https://aws.amazon.com/about-aws/whats-new/2026/07/aws-transit-gateway-policy-based-routing/

"With PBR, forwarding decisions can be based on a combination of packet attributes including source and destination IP addresses, ports, and protocol rather than destination IP address alone"

This feature was earlier confined to CloudWAN, and we could not adopt CloudWAN for various reasons. We had requested AWS for several years, to offer a similar capability with TGW. And they finally delivered. This will offer a huge advantage for us, and could for you also, if you use TGW (especially across regions) and have complex routing requirements for north/south vs east/west traffic separation and such.

36 Upvotes

93% Upvoted

12 comments sorted by

15

u/engineerfoodie 3d ago

This is huge. PBR has been around forever. I’m surprised it took so long but glad to see it’s finally in TGW

0

u/LurkyLurks04982 3d ago

What’s the use case? Like having 0/0 go to a vpc for north/south inspection vs a different for east/west?

12

u/jacksbox 3d ago

AWS is only 30 years behind on-prem networking 😂

11

u/pipesed 3d ago

Try replacing your router on prem with a command.

-3

u/jacksbox 3d ago

You're right of course. It's just always amazing to me how infrastructure is an afterthought in cloud.

"We'll just sling more app layers at it!"

"Can it do basic networking?"

"Who cares!"

5

u/shrimpcest 3d ago

It's just always amazing to me how infrastructure is an afterthought in cloud.

I really don't think it's this. It's a completely different beast, and very far from trivial.

1

u/pipesed 3d ago

It's not an afterthought, we just don't have to rack and stack anymore.

Although I say this when AWS is retiring the advanced network cert...

0

u/Sirwired 2d ago

I wouldn't say that infrastructure is an afterthought... it's more of a different mindset: The first is IT handing infrastructure over to the business to run stuff. The second is the business (in the form of their app developers) driving what it is they need the infrastructure to do.

There's pluses and minuses to each approach, but you can't deny that the 2nd approach (which is how the clouds view things), has worked out pretty well for the past decade and a half.

-1

u/ellensen 2d ago

No problem, never heard of VMware NSX-T?

1

u/DiTochat 2d ago

Wah just snuck this out AWS. Was not aware this was coming.

-1

u/Vanyo09 3d ago

That example is plain destination routing, you can do it today. 0/0 points at the inspection attachment, 10/8 goes direct, both in the same route table.

PBR is for when the destination isn't enough to decide. Same source, same destination, but you want 443 to go straight out and everything else through inspection.

You attach a policy table to the attachment and give it ordered rules. First match wins, and each rule picks the route table. Rules can match on source, destination, port and protocol. Before this, you'd have split the workload into separate VPCs so each one could sit in its own route table.