Lab 13: The Attachment That Joined The Wrong Route Table
A Transit Gateway route table isolates a regulated VPC, and the isolation is correctly built. A second VPC is attached without an explicit association and can send traffic straight into it. Nothing is broken, nothing alarms, and the segmentation on the diagram is not the segmentation in force.
- Debugging time
- ~30 min
- Reading time
- 12 min
- Reported by
- Cloud Security
- Tier
- Specialty
Audit finding: unsegmented VPC has a path into the regulated environment
Reported by Cloud Security
Reachability Analyzer says a host in the general-purpose VPC can reach the regulated VPC across the Transit Gateway. We do not believe it.
The regulated attachment is associated with a dedicated isolation route table. That table has no propagations. We built it specifically so the regulated environment could not talk to anything and nothing could talk to it, and we verified it at the time — from the regulated host, nothing is reachable. That still holds; I just re-checked.
Networking says the isolation table is correct and they are right. Security says the path exists and they are also right. Both of those cannot be true, so one of us is measuring the wrong thing.
Nothing is failing. No alarm has fired. This is an audit finding, not an outage.
What you are working with
One Transit Gateway, two VPCs, one Availability Zone.
The asymmetry is in the VPC route tables and it is deliberate. The general VPC carries a route for 10.110.0.0/16 at the transit gateway; the regulated VPC has no transit gateway route at all, so it can originate nothing across the hub. The regulated workload's security group admits 5000 from its own VPC CIDR only — which is a filter at the interface, not a boundary at the hub.
| Resource | Configuration |
|---|---|
| Transit Gateway | Default association and propagation not specified |
| Regulated VPC | 10.110.0.0/16, workload listening on 5000 |
| General VPC | 10.111.0.0/16 |
| Regulated attachment | Explicitly associated with tgw-rtb-isolation, no propagation |
tgw-rtb-isolation | No routes propagated into it |
| General attachment | No explicit association |
| General VPC route table | 10.110.0.0/16 → Transit Gateway |
sg-regulated | Port 5000 from 10.110.0.0/16 only; ICMP from 10.0.0.0/8 |
The row that matters is the one that says "no explicit association." Everything else in the table is a deliberate decision that someone made correctly.
- EC2
General host
10.111.1.x → 10.110.1.x
- RTB
General VPC route table
10.110.0.0/16 → transit gateway
- GW
TGW default route table
the general attachment is associated here
- VPCE
Regulated attachment ENI
traffic is delivered into 10.110.0.0/16
- DEST
Regulated workload
ICMP answered; TCP 5000 dropped by the security group
The isolation route table is never consulted on this path. It governs what the regulated attachment can send, not what can be sent to it.
Scope and constraints
- In scope: whether a path exists from the general VPC into the regulated VPC, and which route table decides it.
- Out of scope: the isolation route table's contents. It is correct and it does what it was built to do.
- Both teams' observations are accurate. Reconciling them is the exercise.
- The security group on the regulated host is deliberately narrow. It is not the fix — the question is whether the network boundary holds, not whether a second control catches what gets through.
Deploy the broken state
cd lab-13-tgw-default-route-table
terraform init
terraform apply
aws ssm start-session --target "$(terraform output -raw general_instance_id)"The rest of this lab is part of Labs Pro
The reproduction steps, the deployable Terraform, and the debrief with root cause and remediation diff for this lab are available to Labs Pro members. One payment of $49, no subscription, and it covers every Pro lab now and later.
The incident brief is open, so you can see what you would be solving before you decide.
Already bought it? Sign in and it unlocks.
The rest of this lab is part of Labs Pro
The reproduction steps, the deployable Terraform, and the debrief with root cause and remediation diff for this lab are available to Labs Pro members. One payment of $49, no subscription, and it covers every Pro lab now and later.
The incident brief is open, so you can see what you would be solving before you decide.
Already bought it? Sign in and it unlocks.