Why and how to migrate to a Transit Gateway-attached AWS Network Firewall

This article explains how to migrate from traditional inspection VPC architectures to Transit Gateway-attached AWS Network Firewall, which simplifies network architecture and enables flexible cost allocation.

• Transit Gateway-attached Network Firewall eliminates need for dedicated inspection VPC
• Enables flexible cost allocation through Transit Gateway metering policies
• Reduces architectural complexity by removing inspection VPC management overhead
• Two common migration paths: separate inspection/egress VPCs or combined VPC
• Phased migration approach allows parallel testing before production cutover
• Preserve existing NAT gateway Elastic IPs during migration process
• Transit Gateway encryption not currently supported with native attachment
• Detailed migration guides available for Terraform, CloudFormation, and manual console steps

The migration uses a phased approach, testing with single spoke VPCs before migrating remaining traffic, minimizing downtime and risk.