Hub-and-Spoke Model in AWS: Centralized, Secure, and Scalable

When businesses grow in the cloud, they often run into challenges: multiple VPCs, multiple accounts, and scattered connectivity. Without proper design, networks become messy, costly, and difficult to secure.

The Hub-and-Spoke model in AWS solves this by creating a central hub for connectivity and security, while keeping spoke VPCs isolated but connected through the hub.

What is the Hub-and-Spoke Model?
  • Hub → A central VPC or AWS Transit Gateway (TGW) that routes all traffic.
  • Spokes → Individual VPCs (production, staging, dev, shared services) that connect only through the hub.
 Instead of connecting every VPC directly (a web of connections), each spoke connects only once — to the hub.
Benefits of Hub-and-Spoke in AWS
  1. Centralized Security – Deploy a firewall in the hub to inspect all traffic.
  2. Simplified Management – One hub manages all routing and connectivity.
  3. Cost-Effective – Reduces the need for multiple peering connections.
  4. Scalable – Easily add new VPCs without redesigning the entire network.
  5. Multi-Account Friendly – Works well with AWS Organizations and landing zones.
High-Level Steps to Configure
  1. Create Hub → Deploy AWS Transit Gateway in a central account.
  2. Attach Spokes → Connect each VPC (spoke) to the TGW.
  3. Configure Routing → Add spoke CIDRs in TGW and spoke route tables.
  4. Insert Firewall (optional but recommended) → Fortinet, Palo Alto, or AWS Network Firewall in hub.
  5. Test Connectivity → Verify traffic flows between spokes via hub.
Example Use Case

A company has:

  1. Hub Account → Transit Gateway + Firewall.
  2. Spoke 1 → Production VPC (10.1.0.0/16).
  3. Spoke 2 → Staging VPC (10.2.0.0/16).
  4. Spoke 3 → Shared Services VPC (10.3.0.0/16).
  5. Traffic between Prod ↔ Staging goes through the Hub.
  6. Internet access is filtered through firewall in the Hub.
  7. On-premises datacenter connects to the Hub via VPN or Direct Connect.
Summary:-

The Hub-and-Spoke model in AWS is one of the most reliable ways to scale cloud networks securely. It simplifies operations, reduces costs, and ensures all traffic is monitored centrally.

At HackerXone, we recommend every growing AWS environment adopt a Hub-and-Spoke architecture with security baked in from the start.