paths and harness

Architecture

Same relay, two ways in. This lab builds the PrivateLink path; the TGW inspection path already exists in your hub.

Prerequisites Setup the harness

Two paths, one stream

Two paths to one stream: PrivateLink versus TGW with inspection Path A, in teal: the consumer EC2 host resolves an interface VPC endpoint in the consumer VPC, crosses PrivateLink into the provider account, reaches an internal Network Load Balancer on TCP 9000, then the relay instance, which ingests the Wikimedia stream from the public internet. Path B, in amber: the same consumer host routes to the provider private IP through the hub Transit Gateway, into the inspection VPC for Network Firewall inspection, back through the same Transit Gateway, then to the same relay instance on TCP 9000. Path A - PrivateLink 2 accounts - 1 hop - no shared CIDR Consumer VPC Consumer EC2 sub.py Interface endpoint ENI in consumer VPC PrivateLink allowed principal Provider VPC Internal NLB TCP 9000 Relay EC2 relay.py :9000 Public internet Wikimedia SSE endpoint DNS endpoint service target group SSE ingest Path B - TGW + inspection 3 accounts - 2 TGW hops - firewall Consumer VPC Consumer EC2 sub.py Transit Gateway spoke route table Inspection VPC Network Firewall stateful inspection same TGW appliance mode Provider VPC same Relay EC2 private IP :9000 provider CIDR inspection RT no-inspection RT TCP 9000

Teal = PrivateLink (consumer + provider). Amber = TGW hairpin (consumer + network hub + provider). Icons from aws-icons.

Path A PrivateLink EP → NLB → relay · harness adds this
Path B TGW + inspection hairpin via NFW · existing hub
Path C TGW without inspection diagram only · not measured live

Path A uses the endpoint service allowed-principals list (consumer account). No route between VPC CIDRs.

Path B targets the relay private IP. Same relay.py process as Path A.

Path C is the mental model for the hairpin tax (extra TGW hop + firewall). This lab does not re-associate spoke route tables during a run.

What the harness adds

Provider Relay EC2 + relay.py ingest + fan-out on :9000
Provider NLB + endpoint service allows consumer principal
Consumer Interface endpoint DNS name used by sub.py
Consumer sub.py subscribe · PING/PONG RTT · rate

Naming

Thing Value
Resource prefix plvtgw-
Tag demo=pl-vs-inspected-tgw
Stream port 9000

Use the tag for teardown discovery if state files are lost.

Client IP

Path What the relay sees
TGW Consumer host private IP
PrivateLink NLB node address (unless Proxy Protocol v2 on the target group)

Proxy Protocol matters for audit logging. Optional for the latency comparison.

Prerequisites Hub checklist and profiles Setup Prep · provider · consumer Comparison Latency, cost, decision