jajera / pl-vs-inspected-tgw

PrivateLink vs inspected TGW

Same live stream across accounts — PrivateLink one way, Transit Gateway through your inspection hub the other. Stand it up, measure both, keep the path that fits.

Setup the harness Read the comparison

Two paths, one stream

Two paths to one stream: PrivateLink versus TGW with inspection Path A, in teal: the consumer EC2 host resolves an interface VPC endpoint in the consumer VPC, crosses PrivateLink into the provider account, reaches an internal Network Load Balancer on TCP 9000, then the relay instance, which ingests the Wikimedia stream from the public internet. Path B, in amber: the same consumer host routes to the provider private IP through the hub Transit Gateway, into the inspection VPC for Network Firewall inspection, back through the same Transit Gateway, then to the same relay instance on TCP 9000. Path A - PrivateLink 2 accounts - 1 hop - no shared CIDR Consumer VPC Consumer EC2 sub.py Interface endpoint ENI in consumer VPC PrivateLink allowed principal Provider VPC Internal NLB TCP 9000 Relay EC2 relay.py :9000 Public internet Wikimedia SSE endpoint DNS endpoint service target group SSE ingest Path B - TGW + inspection 3 accounts - 2 TGW hops - firewall Consumer VPC Consumer EC2 sub.py Transit Gateway spoke route table Inspection VPC Network Firewall stateful inspection same TGW appliance mode Provider VPC same Relay EC2 private IP :9000 provider CIDR inspection RT no-inspection RT TCP 9000

Teal = PrivateLink (consumer + provider). Amber = TGW hairpin (consumer + network hub + provider). Same relay, same TCP 9000. Icons from aws-icons.

PrivateLink Endpoint -> NLB -> relay harness adds this TGW + inspection Hairpin via firewall existing hub Decision Latency / cost / when each wins measure first
1. Architecture Diagram + what the harness adds 2. Prerequisites Hub + profiles 3. Setup Prep · provider · consumer 4. Measure PrivateLink and TGW (interactive) 5. Comparison Latency, cost, decision 6. Teardown Delete harness resources

Billable while the harness is up: NLB, interface endpoint, and EC2 for relay and subscriber. Tear down when finished - the shared hub stays.