One Firewall to Rule Them All: Hub & Spoke on AWS

You started with an AWS account and a single VPC. Now you’ve got twenty VPCs across an AWS Organization with multi-region deployments, every team wants their own, and nobody can tell you who’s talking to whom or how traffic even reaches the internet. Sound familiar? In this talk I’ll show how a Hub and Spoke architecture solves that problem - centralizing network inspection in a single “hub” while “spoke” VPCs stay clean and focused on workloads. We’ll use AWS Cloud WAN as the global backbone that ties regions together with a single declarative policy, and walk through how to insert a centralized inspection layer - whether that’s a managed AWS service or a third-party firewall - to cover all three traffic directions: egress, ingress, and east-west between spokes. No marketing slides - we’ll talk real design decisions: where to place inspection, why you keep egress inspection regional even on a global network, what it actually costs, and when centralization makes sense versus when it just slows you down. You’ll leave with a clear picture of how to design a network that grows with you, not against you.