📄 AWS Account Creation for Security-Automation & Pen-Test¶

%% IGW-centric Pen-Test VPC : 1 AZ – 3 Subnets
flowchart TD
    %% Core endpoints
    Internet((Internet)):::internet

    subgraph "VPC CIDR/16"[" "]
        direction TB
        IGW["Internet Gateway (IGW)"]:::edge
        NAT["NAT Gateway"]:::edge
        %% Subnets
        subgraph PubA["Public Subnet (ALB) CIDR/24"]
            ALB["ALB / NLB"]
        end
        subgraph PrivApp["Private Subnet (App) CIDR/24"]
            LBD["Lambdas | ECS Tasks | SSM-Bastion-Host (SSH)"]
        end
        subgraph PrivData["Private Subnet (Data) CIDR/24"]
            RDS[(RDS PostgreSQL)]
        end
    end

    %% -----------  Flows (Edges) -----------
    Internet e1@--> |"0.0.0.0/0"|IGW
    IGW      e2@--> |"HTTPS & SSH"|ALB
    ALB      e3@--> |"Service traffic"|LBD
    LBD      e4@--> |"DB Port 5432"|RDS
    NAT      e5@--o |"Outbound TLS & REST API"|IGW
    e1@{ animate: true }
    e2@{ animate: true }
    e3@{ animate: true }
    e4@{ animate: true }
    e5@{ animate: true }

    %% Route table arrows (optional, can omit if too busy)
    PubA     e6@--o |Route 0.0.0.0/0|IGW
    PrivApp  e7@--> |Route 0.0.0.0/0|NAT
    PrivData e8@--> |Route 0.0.0.0/0|NAT
    e6@{ animate: true }
    e7@{ animate: true }
    e8@{ animate: true }

    %% -----------  Styles -----------
    classDef edge fill:,stroke:#268bd2,color:,stroke-width:2px;
    classDef internet fill:#268bd2,stroke:green,color:#fff,font-weight:bold;
    classDef subnet fill:,stroke:#93a1a1,stroke-width:1px;
    class PubA,PrivApp,PrivData subnet;

Legend

• Blue node = external Internet.
• Blue stroke (:::edge) = boundary gateways.
• Grey sub-graphs = subnets.

%% TGW-attached Pen-Test VPC with Central Egress/Inspection VPC
flowchart TB
    %% ───────── Transit-Gateway Hub ─────────
    TGW[(Transit Gateway --> DX/VPN & VPC-Accounts)]:::tgw

    %% ───────── NewAccount (Pen-Test) VPC ─────────
    subgraph "NewAccount VPC CIDR/16"
        direction LR
        NewAccount_Attach("TGW-VPCAttachment – NewAccount"):::attach
        subgraph "Public Subnet CIDR/24"
            ALB2[ALB / NLB]
        end
        subgraph "Private Subnet CIDR/24"
            Scanners[Lambda/ECS Scanners]
        end
    end

    %% ───────── Egress / Inspection VPC ─────────
    subgraph "Egress-Firewall VPC CIDR/16"
        direction LR
        Egress_Attach("TGW-VPCAttachment – Egress-Firewall"):::attach
        NetworkFirewall[AWS Network Firewall]:::inspect
        IGW2[Internet Gateway]:::gateway
    end

    Internet2((Internet)):::internet

     %% ───────── Connectivity ─────────
    NewAccount_Attach e1@-- "TGW Route" --> TGW
    Egress_Attach     e2@-- "TGW Route" --> TGW
    ALB2              e3@-- "0.0.0.0/0 via TGW" --> NewAccount_Attach
    Scanners          e4@-- "0.0.0.0/0 via TGW" --> NewAccount_Attach
    TGW               e5@-- "Propagated Routes" --> Egress_Attach
    NetworkFirewall   e6@--> IGW2
    IGW2              e7@--> Internet2
    e1@{ animate: true }
    e2@{ animate: true }
    e3@{ animate: true }
    e4@{ animate: true }
    e5@{ animate: true }
    e6@{ animate: true }
    e7@{ animate: true }

    %% Styles
    classDef attach   fill:#d33682,color:#fff;
    classDef tgw      fill:#2aa198,color:#fff,font-weight:bold;
    classDef inspect  fill:#b58900,color:#fff;
    classDef gateway  fill:green,stroke:#268bd2,stroke-width:2px;
    classDef internet fill:#268bd2,stroke:#005f87,color:#fff,font-weight:bold;
    %% ───────── Class Assignments ─────────
    class NewAccount_Attach,Egress_Attach attach
    class TGW tgw
    class NetworkFirewall inspect
    class IGW2 gateway
    class Internet2 internet

Key Points

TGW Route Table

┌────────────────────────────────────────┐
│ Destination    | Target                │
│────────────────┼───────────────────────│
│ 0.0.0.0/0      | vpc-egress-attach     │  ← propagated or static
│ 10.77.0.0/16   | vpc-account-attach    │  ← propagated
└────────────────────────────────────────┘