Introduction: This is the second article in the series on AWS Cloud WAN. Here we explain how to design a centralized internet egress point that reduces costs, improves visibility, and increases security in multi-account, multi-region, and multi-VPC architectures. We also include a design with deep packet inspection using AWS Network Firewall and practical recommendations for operating it at global scale.
The problem: In distributed environments without centralized egress, two main problems arise: cost inefficiency and loss of control over outbound traffic. Many teams deploy NAT Gateways in each VPC and in multiple Availability Zones for high availability, which drives up the bill and disperses control and logging points.
Cost impact: In a distributed model, it is common to have multiple NAT Gateways. For example, 5 VPCs across 3 AZs each equals 15 NAT Gateways. At 0.045 per hour per NAT Gateway, the cost would be approximately 0.675 per hour, close to 492.75 per month and around 5913 per year. Trying to centralize one NAT Gateway per region can reduce the hourly price but incurs additional charges for data processing and cross-AZ transfers, which in the long run can be more expensive.
Loss of visibility and control: When traffic exits through multiple NAT Gateways, it becomes complicated to apply consistent security and compliance policies, centralize logging and threat detection, or block and audit suspicious destinations. This increases operational complexity and the risk of non-compliance.
Architecture overview: An efficient solution uses AWS Cloud WAN with Core Network Edges in multiple regions and segments for Dev and Prod. For centralized internet egress, we create a Network Function Group called Egress. NFGs enable service insertion to route traffic toward network functions such as firewalls or inspection appliances.
How to route traffic: With a Cloud WAN policy, traffic from the Prod segment can be directed to the Egress NFG. The Egress VPC is attached to the NFG, and the subnets where attachment interfaces are placed are selected. From there, traffic can be inspected or sent toward the public egress.
Egress VPC design: The Egress VPC typically contains at least three subnets in the simplified example: a private one where the Cloud WAN attachment lands, an inspection one, and a public one that hosts the NAT Gateway. The typical flow is Workload in Prod -> Cloud WAN -> private subnet in Egress -> inspection subnet with Network Firewall -> public subnet with NAT Gateway -> Internet Gateway -> Internet.
Deep inspection with AWS Network Firewall: By adding an inspection subnet and deploying AWS Network Firewall, you get stateful and stateless filtering, URL filtering, and deep packet inspection. When creating the firewall, landing subnets are selected, and AWS provisions endpoints based on Gateway Load Balancer. It is essential to adjust route tables to force traffic through the inspection endpoint before reaching the NAT Gateway or returning to Cloud WAN.
Routing considerations: Although Cloud WAN centralizes policy, it is still necessary to update the route tables of each attached VPC to direct outbound or inspected traffic to the correct Cloud WAN attachment. We recommend using AWS Managed Prefix Lists to group internal CIDR ranges and reference them in routes, avoiding configuration drift and facilitating governance.
Scaling and operational costs: Network Firewall scales with demand but adds processing costs per GB, approximately 0.065 per GB, in addition to NAT Gateway transfer costs and NAT Gateway throughput limits (for example, 45 Gbps per AZ). Modeling these costs and planning horizontal scaling is critical for a realistic deployment.
Security and operations best practices: centralize logging and monitoring, integrate Network Firewall logs with SIEM and detection solutions, automate route and attachment updates using IaC and CI/CD pipelines, and apply least privilege principles and network segmentation with Cloud WAN and NFGs to minimize blast radius.
Lessons learned: When creating a VPC attachment to Cloud WAN, AWS provisions a Transit Gateway-type endpoint; the Cloud WAN foundation relies on Transit Gateway. In Network Firewall, when creating stateless rules, you must configure the action aws:forward_to_sfe so that traffic is evaluated by stateless rule groups. Maintaining managed prefix lists facilitates routing and reduces human errors.
Use cases and flexibility: Some projects only need a central egress point without inspection to save costs. Others require deep inspection for compliance or data leak prevention. With Cloud WAN, both models can coexist and scale globally, allowing different policies to be applied per segment.
About Q2BSTUDIO: Q2BSTUDIO is a custom software and application development company specialized in custom software, artificial intelligence, and cybersecurity. We offer AWS and Azure cloud services, business intelligence services, AI for enterprises, AI agents, and Power BI solutions. We help design secure and scalable architectures like the one described, integrating perimeter security, deep inspection, and automation to reduce costs and improve traffic visibility.
How Q2BSTUDIO can help: Our team implements centralized egress architectures and deep inspection services integrating AWS Cloud WAN, AWS Network Firewall, and complementary solutions. We provide consulting in custom software, custom applications, AI agent integration, and data pipeline development for Power BI, in addition to cybersecurity and artificial intelligence services for enterprises.
Summary and final recommendation: Centralizing egress with Cloud WAN and, when necessary, adding AWS Network Firewall for deep packet inspection allows you to save on operational costs, improve control, and meet security requirements. Plan the sizing of the NAT Gateway and Network Firewall, model transfer and data costs, and automate routing and attachments. If you need help with design, implementation, or automation, contact Q2BSTUDIO for custom solutions in AWS and Azure cloud services, custom software development, artificial intelligence, cybersecurity, AI agents, and Power BI.
