
AWS Network Firewall now supports native attachment to AWS Transit Gateway, eliminating the need for a dedicated inspection VPC and enabling flexible cost allocation through Transit Gateway metering policies.


<div><p>This article explains how to migrate from traditional inspection VPC architectures to Transit Gateway-attached AWS Network Firewall, which simplifies network architecture and enables flexible cost allocation.</p><ul><li>Transit Gateway-attached Network Firewall eliminates need for dedicated inspection VPC</li><li>Enables flexible cost allocation through Transit Gateway metering policies</li><li>Reduces architectural complexity by removing inspection VPC management overhead</li><li>Two common migration paths: separate inspection/egress VPCs or combined VPC</li><li>Phased migration approach allows parallel testing before production cutover</li><li>Preserve existing NAT gateway Elastic IPs during migration process</li><li>Transit Gateway encryption not currently supported with native attachment</li><li>Detailed migration guides available for Terraform, CloudFormation, and manual console steps</li></ul><p>The migration uses a phased approach, testing with single spoke VPCs before migrating remaining traffic, minimizing downtime and risk.</p></div>


Related articles