diff --git a/README.ja.md b/README.ja.md index ec6516b..7df444f 100644 --- a/README.ja.md +++ b/README.ja.md @@ -32,7 +32,7 @@ | 15 | 設計する | 質問に答えると推奨トポロジーと避けるべきパターン | | 16–18 | クイズ・年表・用語集 | 誤解か事実かカード、2009–2026 年のリリース、英日用語集 | -すべての数字の根拠は [`docs/`](docs/README.md) (出典つき、英語) にあります。2026-10-10 時点の AWS 公式ドキュメント・What's New・Price List API で確認済み。 +すべての数字の根拠は [`docs/`](docs/README.md) (出典つき、英語) にあります。2026-10-10 時点の AWS 公式ドキュメント・What's New・Price List API で確認済み。料金・quota・新発表は 2026-11-09 に再確認。 ## Direct Connect 深掘り @@ -56,7 +56,7 @@ | 年表 | 2011〜2026 年のリリース | | 用語集 | 各用語の英語・日本語の正式名と、混同しやすい用語 | -深掘りページの内容は 2026-10-12 時点の AWS 公式ドキュメントで確認済み。 +深掘りページの内容は 2026-10-12 時点の AWS 公式ドキュメントで確認済み。料金・quota・ロケーション・SLA・新発表は 2026-11-09 に再確認。 ## 開発 diff --git a/README.md b/README.md index 5dfd966..4bb2e8e 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ Formerly `0-draft/on-ramp` (renamed 2026-11-08; the old site URL no longer serve | 15 | Plan yours | Questionnaire → recommended topology and anti-patterns | | 16–18 | Quiz, timeline, glossary | Myth-or-fact cards, launches 2009–2026, EN/JA glossary | -The research behind every number lives in [`docs/`](docs/README.md), with sources. Facts were verified against AWS documentation, What's New posts and the AWS Price List API on 2026-10-10. +The research behind every number lives in [`docs/`](docs/README.md), with sources. Facts were verified against AWS documentation, What's New posts and the AWS Price List API on 2026-10-10; prices, quotas and launches were re-checked on 2026-11-09. ## Direct Connect deep dive @@ -56,7 +56,7 @@ The map is every road; the second page, **[Direct Connect, up close](https://0-d | Timeline | 2011–2026 launches | | Glossary | Every term with its official English and Japanese console name and what it is often confused with | -Facts on the deep dive were verified against AWS documentation on 2026-10-12. +Facts on the deep dive were verified against AWS documentation on 2026-10-12; prices, quotas, locations, the SLA and launches were re-checked on 2026-11-09. ## Development diff --git a/docs/02-site-to-site-vpn.md b/docs/02-site-to-site-vpn.md index 8c11c57..edb3f2b 100644 --- a/docs/02-site-to-site-vpn.md +++ b/docs/02-site-to-site-vpn.md @@ -1,6 +1,6 @@ # AWS Site-to-Site VPN -This page covers AWS Site-to-Site VPN, the managed IPsec service that connects an on-premises network (data center, office, branch) to AWS over the internet or over Direct Connect. It covers where a VPN can terminate on the AWS side, the customer gateway, tunnels and routing, crypto options, bandwidth, acceleration, private IP VPN, IPv6, logging, route priority, quotas, pricing and the SLA. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Where AWS sources disagree with each other, the page says so instead of picking one silently. +This page covers AWS Site-to-Site VPN, the managed IPsec service that connects an on-premises network (data center, office, branch) to AWS over the internet or over Direct Connect. It covers where a VPN can terminate on the AWS side, the customer gateway, tunnels and routing, crypto options, bandwidth, acceleration, private IP VPN, IPv6, logging, route priority, quotas, pricing and the SLA. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Where AWS sources disagree with each other, the page says so instead of picking one silently. ## At a glance diff --git a/docs/03-sd-wan-and-connect.md b/docs/03-sd-wan-and-connect.md index 1208c60..e6e0f4e 100644 --- a/docs/03-sd-wan-and-connect.md +++ b/docs/03-sd-wan-and-connect.md @@ -1,6 +1,6 @@ # SD-WAN, Connect attachments and self-managed overlays -This page covers overlay paths between a corporate network and AWS that are not plain AWS Site-to-Site VPN: Transit Gateway Connect (GRE plus BGP), AWS Cloud WAN Connect attachments including Tunnel-less Connect, self-managed VPN or SD-WAN appliances on Amazon EC2 (strongSwan, AWS Marketplace NVAs), and where Gateway Load Balancer fits. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Managed IPsec VPN is covered in `02-site-to-site-vpn.md`. +This page covers overlay paths between a corporate network and AWS that are not plain AWS Site-to-Site VPN: Transit Gateway Connect (GRE plus BGP), AWS Cloud WAN Connect attachments including Tunnel-less Connect, self-managed VPN or SD-WAN appliances on Amazon EC2 (strongSwan, AWS Marketplace NVAs), and where Gateway Load Balancer fits. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Managed IPsec VPN is covered in `02-site-to-site-vpn.md`. ## Why an overlay at all diff --git a/docs/05-hubs.md b/docs/05-hubs.md index 6146f4e..70c6327 100644 --- a/docs/05-hubs.md +++ b/docs/05-hubs.md @@ -1,6 +1,6 @@ # Where the on-prem path lands: AWS-side hubs -This page covers what an on-prem connection (Direct Connect or Site-to-Site VPN) terminates on inside AWS and how routes get from there into VPCs: the virtual private gateway (VGW), the Direct Connect gateway (DXGW), AWS Transit Gateway (TGW) and AWS Cloud WAN. It explains VPC route tables and route propagation, TGW route tables, associations and propagations, Policy-Based Routing (2026), appliance mode, inspection with AWS Network Firewall and Gateway Load Balancer, TGW peering, multi-Region designs, sharing, quotas and prices including Tokyo. Path selection between overlapping routes is in [06-routing-and-path-selection.md](06-routing-and-path-selection.md). Verified against AWS documentation, What's New posts and the AWS Price List API as of 2026-10-10. +This page covers what an on-prem connection (Direct Connect or Site-to-Site VPN) terminates on inside AWS and how routes get from there into VPCs: the virtual private gateway (VGW), the Direct Connect gateway (DXGW), AWS Transit Gateway (TGW) and AWS Cloud WAN. It explains VPC route tables and route propagation, TGW route tables, associations and propagations, Policy-Based Routing (2026), appliance mode, inspection with AWS Network Firewall and Gateway Load Balancer, TGW peering, multi-Region designs, sharing, quotas and prices including Tokyo. Path selection between overlapping routes is in [06-routing-and-path-selection.md](06-routing-and-path-selection.md). Verified against AWS documentation, What's New posts and the AWS Price List API as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. ## The four hubs at a glance @@ -102,7 +102,7 @@ flowchart LR - A static route with the same destination as a propagated route wins and hides the propagated one. Remove the static route and the propagated one reappears. - Blackhole routes drop matching traffic and are the standard way to isolate segments. - The TGW shows only the preferred route for a prefix. A backup (for example VPN behind DX) appears only after the preferred route is withdrawn. -- If a new VPC has the same CIDR as an already attached VPC, its CIDR is not propagated. TGW cannot route between identical CIDRs. +- If a new VPC has the same CIDR as an already attached VPC, its CIDR is not propagated. TGW cannot route between identical CIDRs; since 2026-10-23, 1:1 NAT on the attachment can map the overlapping side (or each side) to its own NAT CIDR ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)). ### Policy-Based Routing (GA 2026-07) @@ -256,12 +256,13 @@ Worked example (Tokyo, own arithmetic): one TGW with 10 VPC attachments and one | 2025-11 | Cloud WAN in Thailand, Taipei and New Zealand | | 2026-04 | Client VPN native TGW attachment | | 2026-07 | TGW Policy-Based Routing (policy tables) | +| 2026-10-23 | TGW and Cloud WAN 1:1 NAT on attachments (static, stateless CIDR-to-CIDR translation) | ## Common traps - A VPC does not learn on-prem routes from a TGW. You must add static routes (or a prefix list) in each subnet route table. - A subnet route to a TGW does nothing for an AZ where the TGW attachment has no subnet. -- Two VPCs with identical CIDRs on one TGW: the second one silently does not propagate. +- Two VPCs with identical CIDRs on one TGW: the second one silently does not propagate. Translate one with 1:1 NAT on its attachment (2026-10) or keep them apart. - TGW allowed prefixes on the DXGW must not overlap across TGWs on the same DXGW. - Forgetting appliance mode on the inspection VPC attachment breaks stateful firewalls only for cross-AZ flows, which makes it look intermittent. - A policy table on a VPN or Connect attachment silently stops BGP advertisements to that peer. @@ -314,3 +315,4 @@ Worked example (Tokyo, own arithmetic): one TGW with 10 VPC attachments and one - - - +- 1:1 NAT in AWS Transit Gateway (2026-10-23): and diff --git a/docs/06-routing-and-path-selection.md b/docs/06-routing-and-path-selection.md index 46edf2d..e8c2d07 100644 --- a/docs/06-routing-and-path-selection.md +++ b/docs/06-routing-and-path-selection.md @@ -170,7 +170,7 @@ AWS does not publish convergence times for propagation inside a VGW, TGW or Clou ## Overlapping CIDRs - On-prem range overlapping a VPC CIDR: the `local` route wins, so that on-prem range is unreachable from the VPC. Renumber or translate (for example with a private NAT gateway). -- Two VPCs with identical CIDRs on one TGW: the second VPC's CIDR is not propagated. TGW cannot route between identical CIDRs. +- Two VPCs with identical CIDRs on one TGW: the second VPC's CIDR is not propagated. TGW cannot route between identical CIDRs. Since 2026-10-23, 1:1 NAT on the TGW attachment maps an original CIDR to a NAT CIDR of the same length, in both directions and without connection state. On TGW: VPC, Direct Connect gateway, Site-to-Site VPN (including Private IP VPN), Connect, peering and VPN Concentrator attachments; not Client VPN; IPv4 only; not on a VPC attachment with appliance mode ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)). - VGW associations on one DXGW need non-overlapping VPC CIDRs. - Allowed prefixes for different TGWs on one DXGW must not overlap. - Overlapping but not identical prefixes are fine everywhere; longest prefix match decides. @@ -316,3 +316,4 @@ DX_EDGE(dst) for private/transit VIFs: - - [direct-connect/06-bgp-and-routing.md](direct-connect/06-bgp-and-routing.md) - [direct-connect/07-resiliency.md](direct-connect/07-resiliency.md) +- 1:1 NAT in AWS Transit Gateway (2026-10-23): and diff --git a/docs/07-user-access.md b/docs/07-user-access.md index 1eec1d0..66a6b96 100644 --- a/docs/07-user-access.md +++ b/docs/07-user-access.md @@ -1,6 +1,6 @@ # User and device access to AWS -This page covers the paths that connect people and their devices (laptops, admin workstations, contractors) to resources in AWS, as opposed to site-to-site paths that connect whole networks. It covers AWS Client VPN, AWS Verified Access, AWS Systems Manager Session Manager, EC2 Instance Connect Endpoint, the "bring the user to AWS" services (Amazon WorkSpaces, Amazon WorkSpaces Applications formerly AppStream 2.0, Amazon WorkSpaces Secure Browser), classic bastion hosts, and how a corporate identity provider (IdP) ties in. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Where something could not be verified, the page says so. +This page covers the paths that connect people and their devices (laptops, admin workstations, contractors) to resources in AWS, as opposed to site-to-site paths that connect whole networks. It covers AWS Client VPN, AWS Verified Access, AWS Systems Manager Session Manager, EC2 Instance Connect Endpoint, the "bring the user to AWS" services (Amazon WorkSpaces, Amazon WorkSpaces Applications formerly AppStream 2.0, Amazon WorkSpaces Secure Browser), classic bastion hosts, and how a corporate identity provider (IdP) ties in. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Where something could not be verified, the page says so. ## At a glance diff --git a/docs/09-private-service-access.md b/docs/09-private-service-access.md index 3d74e61..d4f0b7b 100644 --- a/docs/09-private-service-access.md +++ b/docs/09-private-service-access.md @@ -1,6 +1,6 @@ # Private access to AWS services and SaaS from on-premises -This page covers how a corporate network (data center, office, branch) reaches AWS *service APIs* (S3, DynamoDB, KMS, ECR, STS, ...) and third-party SaaS without the public internet, and the reverse: how AWS workloads reach on-premises services privately. It assumes you already have a Direct Connect (DX) or Site-to-Site VPN path into a VPC (see the earlier pages); here the question is what sits at the AWS end of that path and how the names resolve to it. Verified as of 2026-10-10 against AWS documentation, What's New posts, the AWS Price List API and AWS blogs. Prices are USD for Asia Pacific (Tokyo, `ap-northeast-1`) unless stated. +This page covers how a corporate network (data center, office, branch) reaches AWS *service APIs* (S3, DynamoDB, KMS, ECR, STS, ...) and third-party SaaS without the public internet, and the reverse: how AWS workloads reach on-premises services privately. It assumes you already have a Direct Connect (DX) or Site-to-Site VPN path into a VPC (see the earlier pages); here the question is what sits at the AWS end of that path and how the names resolve to it. Verified as of 2026-10-10 against AWS documentation, What's New posts, the AWS Price List API and AWS blogs. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Prices are USD for Asia Pacific (Tokyo, `ap-northeast-1`) unless stated. ## The one rule that explains everything diff --git a/docs/10-hybrid-dns.md b/docs/10-hybrid-dns.md index e9381c5..271a1d9 100644 --- a/docs/10-hybrid-dns.md +++ b/docs/10-hybrid-dns.md @@ -1,6 +1,6 @@ # Hybrid DNS: Route 53 VPC Resolver, endpoints, rules and Profiles -A private path is useless if the name resolves to the wrong address: an on-prem host that resolves `s3.ap-northeast-1.amazonaws.com` to a public IP will ignore your interface endpoint, and an EC2 instance that cannot resolve `corp.example.com` will never use your Direct Connect. This page covers Route 53 VPC Resolver (renamed from "Route 53 Resolver" in November 2025), inbound and outbound Resolver endpoints, forwarding/system/delegation rules, sharing via AWS RAM and Route 53 Profiles, private hosted zones, DNS Firewall, query logging, Resolver on Outposts, DNS over HTTPS, and the newer Global Resolver. Verified as of 2026-10-10 against Route 53 documentation, What's New posts, AWS blogs and the AWS Price List API. Prices are USD for Asia Pacific (Tokyo) unless stated. +A private path is useless if the name resolves to the wrong address: an on-prem host that resolves `s3.ap-northeast-1.amazonaws.com` to a public IP will ignore your interface endpoint, and an EC2 instance that cannot resolve `corp.example.com` will never use your Direct Connect. This page covers Route 53 VPC Resolver (renamed from "Route 53 Resolver" in November 2025), inbound and outbound Resolver endpoints, forwarding/system/delegation rules, sharing via AWS RAM and Route 53 Profiles, private hosted zones, DNS Firewall, query logging, Resolver on Outposts, DNS over HTTPS, and the newer Global Resolver. Verified as of 2026-10-10 against Route 53 documentation, What's New posts, AWS blogs and the AWS Price List API. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Prices are USD for Asia Pacific (Tokyo) unless stated. ## The building blocks diff --git a/docs/12-security-and-operations.md b/docs/12-security-and-operations.md index 1321048..ddb141d 100644 --- a/docs/12-security-and-operations.md +++ b/docs/12-security-and-operations.md @@ -32,11 +32,12 @@ VPC Encryption Controls (launched 2025-11, paid from 2026-03-01, declarative org | Private NAT + ALB/NLB in the other network | SNAT on one side, load balancer as DNAT on the other | Both, per service | NAT + LB charges | | PrivateLink (NLB endpoint service) | Consumers get an endpoint IP in their own CIDR; overlap is irrelevant | Consumer → service | Endpoint $0.014/h per AZ + $0.01/GB | | PrivateLink tunnel endpoints (2026-09) | Share a resource configuration that represents a whole CIDR range via RAM; the consumer reaches it with GENEVE-encapsulated tunnel endpoint | Consumer → network segment | $0.028/h + $0.01/GB (first PB) | +| TGW / Cloud WAN 1:1 NAT (2026-10-23) | A per-attachment rule maps an original CIDR to a NAT CIDR of the same prefix length; static and stateless, host bits kept, both directions. On TGW: VPC, Direct Connect gateway, Site-to-Site VPN (including Private IP VPN), Connect, peering and VPN Concentrator attachments; not Client VPN; IPv4 only; not on a VPC attachment with appliance mode ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)) | Both | Not checked (see Amazon VPC pricing) | | Outposts CoIP | LGW 1:1 NATs Outpost instances to an on-prem-owned pool | Both | Included in Outposts | | NAT on the customer router / firewall | Translate on-prem side before it reaches AWS | Either | Your equipment | | IPv6 | Global unique addressing removes the overlap problem | Both | — | -Transit Gateway and VPC peering cannot route between identical CIDRs; one side has to be translated or hidden behind an endpoint. +Transit Gateway and VPC peering cannot route between identical CIDRs; one side has to be translated or hidden behind an endpoint. Since 2026-10-23 the translation can happen on the TGW or Cloud WAN attachment itself (1:1 NAT), with no NAT gateway or appliance to run. ## IPv6 on each path @@ -249,3 +250,4 @@ The per-GB saving of DX over internet in Tokyo is 0.114 − 0.041 = $0.073/GB in - - - AWS Price List API offer files for ap-northeast-1 (AmazonVPC, AmazonEC2, AWSDataTransfer, AWSDirectConnect, AWSCloudWAN, AmazonCloudWatch, AWSDataSync, AWSTransfer), fetched 2026-10-10: +- 1:1 NAT in AWS Transit Gateway (2026-10-23): and diff --git a/docs/13-design-patterns.md b/docs/13-design-patterns.md index 8140ea4..cd1e9a9 100644 --- a/docs/13-design-patterns.md +++ b/docs/13-design-patterns.md @@ -53,7 +53,7 @@ Each rule reads `if then `. Earlier rules win. `alt` 13. `uses_dx AND regions > 1` → **P3**: DXGW + Cloud WAN (native DXGW attachment since 2024-11) or DXGW + TGW per Region with TGW peering. 14. `uses_dx AND encryption_required AND dedicated_speed >= 10 Gbps AND macsec_location AND (own_port OR carrier_is_l2_transparent)` → **MACsec** (it needs a dedicated port and a direct Layer 2 adjacency, so it does not cover a hosted connection or a carrier that is not L2 transparent); else **Private IP VPN over transit VIF** (needs TGW). 15. `internet_egress_allowed = false` → **P5 closed network**: no IGW (enforce with VPC Block Public Access), interface endpoints, Resolver endpoints, Route 53 Profiles. -16. `cidr_overlaps_with_onprem_or_acquired = true` → **P7 overlap pattern**: service-level exposure (PrivateLink / Lattice resource configurations) first, private NAT gateway second, re-IP long term. +16. `cidr_overlaps_with_onprem_or_acquired = true` → **P7 overlap pattern**: service-level exposure (PrivateLink / Lattice resource configurations) for single services, 1:1 NAT on the TGW or Cloud WAN attachment (2026-10) for whole networks, re-IP long term. 17. `workload_critical = true AND uses_dx` → resiliency **Maximum** (99.99% SLA: two or more connections on separate devices in each of two or more DX locations, four or more in total; needs Enterprise Support and a Well-Architected Review), else **High** (99.9%: one connection in each of two or more locations; needs Enterprise Support), and **Development and test** only for non-critical. ## Pattern P1: small office, one VPC (VPN to VGW) @@ -169,7 +169,8 @@ flowchart LR ## Pattern P7: M&A and overlapping CIDRs - First choice, **expose services rather than networks**: PrivateLink endpoint services (NLB-fronted), or PrivateLink resource endpoints and VPC Lattice resource configurations (2024-12). These reach a database or IP in an overlapping network without routing the whole CIDR. -- Second choice, **private NAT gateway**: add a routable secondary CIDR, use the private NAT gateway for source NAT and an internal ALB or NLB for destination NAT, and route through TGW or VGW. This is the pattern in the multi-VPC whitepaper and the re:Post Knowledge Center. +- When whole networks must talk, **1:1 NAT on the TGW or Cloud WAN attachment** (2026-10-23): a per-attachment rule maps an original CIDR to a NAT CIDR of the same prefix length, statelessly and in both directions, so either side can start connections. On TGW: VPC, Direct Connect gateway, Site-to-Site VPN (including Private IP VPN), Connect, peering and VPN Concentrator attachments; not Client VPN; IPv4 only; not on a VPC attachment with appliance mode ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)). +- Without TGW or Cloud WAN, **private NAT gateway**: add a routable secondary CIDR, use the private NAT gateway for source NAT and an internal ALB or NLB for destination NAT, and route through TGW or VGW. This is the pattern in the multi-VPC whitepaper and the re:Post Knowledge Center. - Constraint to remember: VPCs associated with one DXGW through VGWs cannot have overlapping CIDRs. - New tool: TGW Policy-Based Routing (2026-07) can steer by source, port or protocol. It helps with segmentation during a migration, but it does not translate addresses. - Long term: re-IP from a planned IPAM pool. The whitepaper treats IP planning as step zero for this reason. @@ -246,3 +247,4 @@ The Hybrid Networking Lens (2026-02-02 revision) applies the six pillars to hybr - - - +- 1:1 NAT in AWS Transit Gateway (2026-10-23): and diff --git a/docs/14-why-hybrid-is-hard.md b/docs/14-why-hybrid-is-hard.md index d56d30e..0926a67 100644 --- a/docs/14-why-hybrid-is-hard.md +++ b/docs/14-why-hybrid-is-hard.md @@ -34,7 +34,7 @@ flowchart LR | 10 | **Asymmetric and flapping tunnels** | Static-route VPN on a stateful firewall drops return traffic; tunnels go down "when idle" | re:Post "avoid asymmetry in route-based VPN with static routing"; re:Post "troubleshoot tunnel inactivity, flapping, or down tunnel" (DPD every 10 s, 3 misses) | Two-tunnel animation showing the return packet taking the other tunnel and the firewall dropping it; a DPD heartbeat visual | | 11 | **MTU and PMTUD** | Large packets black-hole after failover from DX (8500/9001) to VPN (max 1446) | AWS blog "Improving Performance on AWS and Hybrid Networks"; DX VIF MTU docs | A packet-size slider across a path picker; show fragmentation or drop where ICMP is blocked, and the fix (MSS clamping) | | 12 | **Edge-to-edge / transitive routing** | Reach a peered VPC through another VPC's VPN or DX link | re:Post "troubleshoot communication issues between Amazon VPCs over VPC peering": "VPC peering doesn't support edge-to-edge routing"; DX FAQ | A "can this packet get there?" maze with VGW, peering, TGW; only hub-based routes succeed | -| 13 | **Overlapping CIDRs** | Assume TGW or DXGW can route overlapping VPCs and on-prem | DX docs: VPCs on one DXGW "cannot have overlapping CIDR blocks"; whitepaper "Private NAT Gateway"; re:Post "Use AWS Transit Gateway for overlapping CIDR blocks" | An IP-collision game: drop two 10.0.0.0/16 networks onto a hub and pick a fix (PrivateLink, private NAT, re-IP) to see trade-offs | +| 13 | **Overlapping CIDRs** | Assume TGW or DXGW can route overlapping VPCs and on-prem | DX docs: VPCs on one DXGW "cannot have overlapping CIDR blocks"; whitepaper "Private NAT Gateway"; re:Post "Use AWS Transit Gateway for overlapping CIDR blocks" | An IP-collision game: drop two 10.0.0.0/16 networks onto a hub and pick a fix (PrivateLink, private NAT, TGW / Cloud WAN 1:1 NAT since 2026-10, re-IP) to see trade-offs | | 14 | **"Remote access" means three products** | Confuse Site-to-Site VPN, Client VPN and Verified Access (and WorkSpaces) when planning remote work | AWS VPN decision-framework blog (five VPN options, 2026-05); Client VPN vs Verified Access positioning | A persona switcher: pick "branch", "employee laptop", "contractor needing one app", "admin" and see the right product and its layer | | 15 | **What "閉域" (closed network) requires** | Treat "we use DX" as satisfying "no internet", forgetting AWS API calls, DNS, IGWs and console access | SIOS blog "AWSで「インターネットに出てはいけない」要件を解決する方法～PrivateLink対応～"; Classmethod endpoint/Resolver consolidation articles; Serverworks Resolver + DNS Firewall article | A checklist overlay on the big map: each item (circuit, encryption, DNS, endpoints, no IGW via Block Public Access, console access) turns green only when its layer is closed | diff --git a/docs/15-timeline.md b/docs/15-timeline.md index 1ca6b4b..64fa223 100644 --- a/docs/15-timeline.md +++ b/docs/15-timeline.md @@ -1,6 +1,6 @@ # Timeline of AWS hybrid networking, 2009–2026 -This page lists the launches that changed how a corporate network can reach AWS. It starts with Amazon VPC and its IPsec VPN in 2009 and runs through the 2025–2026 wave (large VPN tunnels, VPN Concentrator, AWS Interconnect, Client VPN on Transit Gateway, Direct Connect flat-rate pricing). Verified as of 2026-10-10. Each entry links to the AWS What's New post or, where that post could not be found, to the AWS blog or doc that records the date. Dates are the posted date when it was confirmed. `YYYY-MM` means only the month was confirmed (from the What's New URL path). Regional expansions are left out unless they changed what was possible. +This page lists the launches that changed how a corporate network can reach AWS. It starts with Amazon VPC and its IPsec VPN in 2009 and runs through the 2025–2026 wave (large VPN tunnels, VPN Concentrator, AWS Interconnect, Client VPN on Transit Gateway, Direct Connect flat-rate pricing). Verified as of 2026-10-10; launches re-checked through 2026-11-09. Each entry links to the AWS What's New post or, where that post could not be found, to the AWS blog or doc that records the date. Dates are the posted date when it was confirmed. `YYYY-MM` means only the month was confirmed (from the What's New URL path). Regional expansions are left out unless they changed what was possible. ## Eras at a glance @@ -94,6 +94,7 @@ timeline | 2026-09-15 | Direct Connect flat-rate pricing (10G/100G dedicated; port-pair) | No per-GB DTO within tier; second port in a pair at no charge | | | 2026-09-18 | PrivateLink tunnel endpoints | A consumer reaches a whole shared CIDR range (including on-premises) through one endpoint | | | 2026-10-05 | Client VPN device posture assessment (CrowdStrike, Jamf, JumpCloud) | Posture checks move into network VPN | | +| 2026-10-23 | Transit Gateway and Cloud WAN 1:1 NAT | Overlapping networks talk through the hub without renumbering or NAT appliances | | ## Availability changes worth knowing diff --git a/docs/README.md b/docs/README.md index 0354aae..98effda 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # Research notes -Everything the site says is backed by these notes. Each page ends with the AWS documentation, What's New posts, pricing pages and blogs it was checked against. All pages were verified on 2026-10-10. Prices are USD list prices, mostly for Asia Pacific (Tokyo), taken from the AWS Price List API. +Everything the site says is backed by these notes. Each page ends with the AWS documentation, What's New posts, pricing pages and blogs it was checked against. All pages were verified on 2026-10-10; prices, quotas and launches were re-checked on 2026-11-09 (pages that were re-checked say so in their opening paragraph). Prices are USD list prices, mostly for Asia Pacific (Tokyo), taken from the AWS Price List API. | # | Page | Covers | | --- | --- | --- | diff --git a/docs/direct-connect/01-overview.md b/docs/direct-connect/01-overview.md index e383acf..39afe96 100644 --- a/docs/direct-connect/01-overview.md +++ b/docs/direct-connect/01-overview.md @@ -1,6 +1,6 @@ # AWS Direct Connect Overview -AWS Direct Connect (DX) links your internal network to a Direct Connect location over a standard Ethernet fiber-optic cable, so you can reach AWS public services and your VPCs without going through internet service providers. This page explains what DX is, its building blocks, when to pick it over Site-to-Site VPN or the internet, and what changed between 2023 and 2026. Facts were verified against AWS documentation and What's New posts as of 2026-10-12. +AWS Direct Connect (DX) links your internal network to a Direct Connect location over a standard Ethernet fiber-optic cable, so you can reach AWS public services and your VPCs without going through internet service providers. This page explains what DX is, its building blocks, when to pick it over Site-to-Site VPN or the internet, and what changed between 2023 and 2026. Facts were verified against AWS documentation and What's New posts as of 2026-10-12; launches re-checked on 2026-11-09. ## What Direct Connect is @@ -98,7 +98,7 @@ Buildings that together form one Direct Connect location (for example Equinix DC | 2024-07-01 | Native 400 Gbps dedicated connections at select locations (400GBASE-LR4) | Connection | | Undated (current docs) | MACsec documented for 400 Gbps dedicated connections (GCM-AES-XPN-256); the 400G launch post of 2024-07-01 did not mention MACsec, and the locations page now marks all 400G sites with (M) | Connection | | 2025-07 | MACsec extended to partner-owned interconnects at 100+ PoPs | Connection | -| 2025 to 2026 | Steady location growth: e.g. Barcelona (2025-08), Auckland, Nairobi, Madrid MAD3 (2025-09), Hanoi (2025-12, first in Vietnam), Sydney SY5 (2026-03); 100G expansions in Chennai, Kansas City, Makati, Auckland, Lima | Locations | +| 2025 to 2026 | Steady location growth: e.g. Barcelona (2025-08), Auckland, Nairobi, Madrid MAD3 (2025-09), Hanoi (2025-12, first in Vietnam), Sydney SY5 (2026-03); 100G expansions in Chennai, Kansas City, Makati, Auckland, Lima, Manchester, Bangalore | Locations | | 2025-11 | AWS Interconnect - last mile (Lumen) gated preview; GA 2026-04; AT&T gated preview 2026-06 | Adjacent product | | 2025-11 | AWS Interconnect - multicloud preview; GA 2026-04-13; free 500 Mbps tier 2026-05 | Adjacent product | | 2025-12 | Resilience testing of DX BGP failover with AWS Fault Injection Service | Operations | diff --git a/docs/direct-connect/02-connections.md b/docs/direct-connect/02-connections.md index f330191..b0222d5 100644 --- a/docs/direct-connect/02-connections.md +++ b/docs/direct-connect/02-connections.md @@ -1,6 +1,6 @@ # Direct Connect Connections, Locations, and Ordering -This page covers the physical and connection layer of AWS Direct Connect: dedicated vs hosted connections, hosted connections vs hosted VIFs, Direct Connect locations and how they map to Regions, the LOA-CFA and cross connect workflow with its timelines, physical requirements (optics, fiber, auto-negotiation, VLANs, BGP, BFD, MTU), and the quotas that apply to connections. Verified against AWS documentation as of 2026-10-12. +This page covers the physical and connection layer of AWS Direct Connect: dedicated vs hosted connections, hosted connections vs hosted VIFs, Direct Connect locations and how they map to Regions, the LOA-CFA and cross connect workflow with its timelines, physical requirements (optics, fiber, auto-negotiation, VLANs, BGP, BFD, MTU), and the quotas that apply to connections. Verified against AWS documentation as of 2026-10-12; quotas and locations re-checked on 2026-11-09. ## Connection types @@ -60,7 +60,7 @@ A Direct Connect location is a colocation facility (for example Equinix, CoreSit ### Speeds per location -The locations page lists each site's speeds in an "Available as" column and marks MACsec support per speed with "(M)". Examples as of 2026-10-12: +The locations page lists each site's speeds in an "Available as" column and marks MACsec support per speed with "(M)". Examples as of 2026-10-12 (re-checked 2026-11-09): | Location | Available as | | --- | --- | @@ -91,6 +91,7 @@ The 400G sites listed on the locations page are all in the United States: CoreSi | 2026-03 | Equinix SY5, Sydney (tenth in Australia) | 10G, 100G with MACsec | | 2026-04 | Datacom Orbit DH6, Auckland (100G expansion) | 100G with MACsec | | 2026-07 | Cirion, Lima, Peru (100G expansion, first 100G/MACsec in Peru) | 100G with MACsec | +| 2026-10 | Equinix MA3, Manchester ([100G expansion](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-direct-connect-100g-manchester/)); Netmagic DC2, Bangalore ([100G expansion](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-direct-connect-100g-bangalore/)) | Manchester 10G, 100G with MACsec; Bangalore 100G | ## Connectivity options to reach a location diff --git a/docs/direct-connect/07-resiliency.md b/docs/direct-connect/07-resiliency.md index cd72a97..84b0cc7 100644 --- a/docs/direct-connect/07-resiliency.md +++ b/docs/direct-connect/07-resiliency.md @@ -2,7 +2,7 @@ Direct Connect (DX) is a physical service: a fiber, an optic, a router port, and a building. Any one of them can fail, and AWS also takes DX devices down for maintenance. This page covers the Resiliency Toolkit models, the SLA tiers and what you must build to qualify for them, failover testing, fast failure detection with BFD, active/active versus active/passive routing, and VPN as a backup path. -_Last verified: 2026-10-12. SLA text last updated by AWS on 2026-07-24._ +_Last verified: 2026-10-12; SLA re-checked 2026-11-09. SLA text last updated by AWS on 2026-07-24._ ## Why resiliency matters for DX diff --git a/docs/direct-connect/10-pricing.md b/docs/direct-connect/10-pricing.md index ff6bada..cc6134a 100644 --- a/docs/direct-connect/10-pricing.md +++ b/docs/direct-connect/10-pricing.md @@ -9,7 +9,7 @@ Direct Connect has two billing modes as of September 2026: Data into AWS over DX is always free. Cross-connect and colocation fees come from the facility operator, not AWS. -_Prices are USD list prices taken from aws.amazon.com/directconnect/pricing on 2026-10-12, and they exclude tax (Japanese Consumption Tax applies to customers with a Japanese billing address). AWS pricing changes. Always check the live page or the AWS Pricing Calculator. Monthly figures assume 730 hours._ +_Prices are USD list prices taken from aws.amazon.com/directconnect/pricing on 2026-10-12 (re-checked unchanged on 2026-11-09), and they exclude tax (Japanese Consumption Tax applies to customers with a Japanese billing address). AWS pricing changes. Always check the live page or the AWS Pricing Calculator. Monthly figures assume 730 hours._ ## What you pay for diff --git a/docs/direct-connect/12-timeline.md b/docs/direct-connect/12-timeline.md index 07d667a..5ede0b5 100644 --- a/docs/direct-connect/12-timeline.md +++ b/docs/direct-connect/12-timeline.md @@ -2,7 +2,7 @@ This is a dated history of notable AWS Direct Connect launches, from the 2011 public release to the 2026 flat-rate pricing. Dates come from the DX User Guide document history and from AWS What's New posts. Where the two differ, both are noted. -_Last verified: 2026-10-12._ +_Last verified: 2026-10-12; launches re-checked through 2026-11-09._ > Note: Direct Connect launched on **2011-08-03**, not 2012. The 2012 milestones are the new console, the User Guide, IAM support, and more Regions. @@ -79,7 +79,7 @@ timeline ## Location footprint -AWS What's New posts give the running count of DX locations: "over 142" (2025-08), "over 146" (2025-09 to 2025-10), "over 149" (2025-12), and "over 150" (2026-03 to 2026-04). Recent additions include Hanoi (the first in Vietnam, 2025-12) and Sydney SY5 (2026-03). 100G expansions include Kansas City (2025-10), Auckland (2026-04), and Lima (2026-07). Two locations are winding down: per the locations page, GDS No. 3 Shenzhen and Equinix MU1 Munich take no new connections after July 1, 2026 and reach end of support in July 2027. The document history gives the same Shenzhen cutoff as "after June 30, 2026". +AWS What's New posts give the running count of DX locations: "over 142" (2025-08), "over 146" (2025-09 to 2025-10), "over 149" (2025-12), and "over 150" (2026-03 to 2026-04). Recent additions include Hanoi (the first in Vietnam, 2025-12) and Sydney SY5 (2026-03). 100G expansions include Kansas City (2025-10), Auckland (2026-04), Lima (2026-07), Manchester and Bangalore (2026-10). Two locations are winding down: per the locations page, GDS No. 3 Shenzhen and Equinix MU1 Munich take no new connections after July 1, 2026 and reach end of support in July 2027. The document history gives the same Shenzhen cutoff as "after June 30, 2026". ## Sources @@ -119,5 +119,7 @@ AWS What's New posts give the running count of DX locations: "over 142" (2025-08 - BGP route visibility (2026-07): - Interconnect with Azure preview (2026-08): - Prefix controls (2026-08-20): +- Manchester 100G (2026-10-21): +- Bangalore 100G (2026-10-22): - Flat-rate pricing (2026-09-15): - DX SLA: diff --git a/src/components/layout/Footer.tsx b/src/components/layout/Footer.tsx index ad26ab8..ef70047 100644 --- a/src/components/layout/Footer.tsx +++ b/src/components/layout/Footer.tsx @@ -10,8 +10,8 @@ const C = { ja: "AWS とは無関係の非公式解説です。料金やクォータは変わるので、設計・購入前に必ず AWS 公式ドキュメントを確認してください。", }, asOf: (d: string) => ({ - en: `Facts verified against AWS documentation, What's New posts and the AWS Price List API as of ${d}. Prices are USD list prices.`, - ja: `記載内容は ${d} 時点の AWS 公式ドキュメント・What's New・Price List API で確認済み。料金は USD の表示価格です。`, + en: `Prices, quotas and launches checked against AWS documentation, What's New posts and the AWS Price List API as of ${d}; each research note gives its own verification date. Prices are USD list prices.`, + ja: `料金・クォータ・新発表は ${d} 時点の AWS 公式ドキュメント・What's New・Price List API で確認済み (各調査ノートに個別の確認日あり)。料金は USD の表示価格です。`, }), notes: { en: "Research notes (Markdown, with sources)", diff --git a/src/data/asOf.ts b/src/data/asOf.ts index 48ff811..8e68508 100644 --- a/src/data/asOf.ts +++ b/src/data/asOf.ts @@ -1,8 +1,12 @@ -/** The date every fact and list price on the site was last verified. */ -export const AS_OF = "2026-10-10"; +/** + * The date the road map's list prices, quotas and launches were last checked + * (the monthly freshness pass). Each docs/ page states its own full + * verification date. + */ +export const AS_OF = "2026-11-09"; /** - * The date the Direct Connect deep dive (direct-connect/) and the shared DX - * price list in @/data/dxPricing were last verified. + * The date the Direct Connect deep dive's prices, quotas, locations, SLA and + * launches (and the shared DX price list in @/data/dxPricing) were last checked. */ -export const DX_AS_OF = "2026-10-12"; +export const DX_AS_OF = "2026-11-09"; diff --git a/src/data/dxPricing.ts b/src/data/dxPricing.ts index a4e9796..d983af7 100644 --- a/src/data/dxPricing.ts +++ b/src/data/dxPricing.ts @@ -6,7 +6,7 @@ import { DX_AS_OF } from "./asOf"; * from here, and docs/direct-connect/10-pricing.md is the matching research * note. Monthly figures use 730 hours, as AWS's own examples do. * - * Sources, all read on DX_AS_OF (2026-10-12): + * Sources, all read on DX_AS_OF (2026-11-09): * - Pay-as-you-go port-hours, the DTO matrix and SiteLink: * https://aws.amazon.com/directconnect/pricing/ * - The Japan columns, cross-checked against the AWS Price List API @@ -15,8 +15,8 @@ import { DX_AS_OF } from "./asOf"; * https://aws.amazon.com/directconnect/pricing/flat-rate/ and * https://docs.aws.amazon.com/directconnect/latest/PricingGuide/pricing-flat-rate.html * - * The road map's own AS_OF (2026-10-10) is older: its non-DX prices were read - * then. The Japan DX values here were unchanged between the two reads. + * Both pages were re-checked on 2026-11-09 (Price List API publication + * 2026-11-08); no DX or road-map price changed. */ export const HOURS_PER_MONTH = 730; diff --git a/src/features/direct-connect/content/ui.ts b/src/features/direct-connect/content/ui.ts index 7fc039d..54076e1 100644 --- a/src/features/direct-connect/content/ui.ts +++ b/src/features/direct-connect/content/ui.ts @@ -7,7 +7,7 @@ export const UI = { ja: "図の各パーツをタップ (クリック) すると解説が出ます。", }, asOf: { - en: `Facts verified against AWS documentation as of ${DX_AS_OF}.`, - ja: `記載内容は ${DX_AS_OF} 時点の AWS 公式ドキュメントで確認済み。`, + en: `Prices, quotas, locations, the SLA and launches checked against AWS documentation as of ${DX_AS_OF}; each research note gives its own verification date.`, + ja: `料金・クォータ・ロケーション・SLA・新発表は ${DX_AS_OF} 時点の AWS 公式ドキュメントで確認済み (各調査ノートに個別の確認日あり)。`, }, } satisfies Record; diff --git a/src/features/hubs/HubsSection.tsx b/src/features/hubs/HubsSection.tsx index 916394d..1fb0238 100644 --- a/src/features/hubs/HubsSection.tsx +++ b/src/features/hubs/HubsSection.tsx @@ -236,8 +236,8 @@ export function HubsSection() { ja: "許可されたプレフィックスはそのまま広告されます。DX ゲートウェイの TGW 関連付けでは、オンプレが受け取るのは設定した許可されたプレフィックスそのもの (最大 200) で、VPC の CIDR ではありません。VGW 関連付けでは同じ項目がフィルターとして働くだけです。", }, { - en: "Identical CIDRs silently vanish. Attach a second VPC with the same CIDR to one Transit Gateway and its CIDR is simply not propagated: a TGW cannot route between identical CIDRs.", - ja: "同じ CIDR は黙って消えます。同じ CIDR の VPC を 2 つ目として同じ Transit Gateway につなぐと、その CIDR は伝播されません。TGW は同一 CIDR 間をルーティングできません。", + en: "Identical CIDRs silently vanish. Attach a second VPC with the same CIDR to one Transit Gateway and its CIDR is simply not propagated: a TGW cannot route between identical CIDRs. Since 2026-10, 1:1 NAT on the attachment can map one of them to its own NAT CIDR first.", + ja: "同じ CIDR は黙って消えます。同じ CIDR の VPC を 2 つ目として同じ Transit Gateway につなぐと、その CIDR は伝播されません。TGW は同一 CIDR 間をルーティングできません。2026-10 からは、アタッチメントの 1:1 NAT で片方を専用の NAT CIDR に変換してから通せます。", }, { en: "Cloud WAN edges bill whether used or not: each core network edge costs $0.50 per hour in every Region you list, before any attachment or traffic.", diff --git a/src/features/plan/PlanSection.tsx b/src/features/plan/PlanSection.tsx index fe59d5c..35fb4ba 100644 --- a/src/features/plan/PlanSection.tsx +++ b/src/features/plan/PlanSection.tsx @@ -88,8 +88,8 @@ const PATTERNS: { id: string; routes: RouteId[]; name: L; what: L; upgrade: L }[ routes: ["private"], name: { en: "M&A, overlapping CIDRs", ja: "M&A・CIDR 重複" }, what: { - en: "Expose services through PrivateLink or VPC Lattice resource configurations, then private NAT gateway, then re-IP.", - ja: "PrivateLink か VPC Lattice のリソース設定でサービスを公開、次にプライベート NAT ゲートウェイ、最終的に再採番。", + en: "Expose services through PrivateLink or VPC Lattice resource configurations; translate whole networks with 1:1 NAT on the TGW or Cloud WAN attachment (2026-10); re-IP in the long run.", + ja: "PrivateLink か VPC Lattice のリソース設定でサービスを公開。ネットワーク同士は TGW / Cloud WAN のアタッチメントの 1:1 NAT (2026-10) で変換。最終的に再採番。", }, upgrade: { en: "Policy-Based Routing (2026-07) steers traffic but does not translate addresses.", diff --git a/src/features/plan/advisor.ts b/src/features/plan/advisor.ts index c958749..9de585f 100644 --- a/src/features/plan/advisor.ts +++ b/src/features/plan/advisor.ts @@ -331,12 +331,12 @@ export const REC: Record = { }, overlap: { title: { - en: "Expose services, not networks", - ja: "ネットワークでなくサービスを公開", + en: "Expose services; translate networks", + ja: "サービスは公開、ネットワークは変換", }, why: { - en: "PrivateLink or VPC Lattice resource configurations first, a private NAT gateway second, re-IP from an IPAM plan in the long run. No hub can route between identical CIDRs.", - ja: "まず PrivateLink か VPC Lattice のリソース設定、次にプライベート NAT ゲートウェイ、長期的には IPAM 計画で再採番。同一 CIDR 間はどのハブもルーティングできない。", + en: "PrivateLink or VPC Lattice resource configurations for single services; for whole networks, 1:1 NAT on the Transit Gateway or Cloud WAN attachment (2026-10) maps the overlapping side, or each side, to its own NAT CIDR (on TGW: IPv4 only, not with appliance mode); re-IP from an IPAM plan in the long run. No hub routes between identical CIDRs untranslated.", + ja: "単一サービスなら PrivateLink か VPC Lattice のリソース設定。ネットワーク同士なら Transit Gateway / Cloud WAN のアタッチメントの 1:1 NAT (2026-10) で重複する側 (または両側) を専用の NAT CIDR に変換する (TGW では IPv4 のみ、アプライアンスモードとは併用不可)。長期的には IPAM 計画で再採番。変換なしで同一 CIDR 間をルーティングできるハブはない。", }, }, resilMax: { diff --git a/src/features/timeline/data.ts b/src/features/timeline/data.ts index db70daa..c07456f 100644 --- a/src/features/timeline/data.ts +++ b/src/features/timeline/data.ts @@ -839,6 +839,19 @@ const RAW: Launch[] = [ }, url: `${W}2026/10/aws-client-vpn-device-posture/`, }, + { + date: "2026-10-23", + family: "hub", + title: { + en: "Transit Gateway and Cloud WAN 1:1 NAT", + ja: "Transit Gateway と Cloud WAN の 1:1 NAT", + }, + why: { + en: "Overlapping networks talk through the hub without renumbering or NAT appliances", + ja: "重複したネットワーク同士が、再採番も NAT アプライアンスもなしにハブ経由で通信できる", + }, + url: `${W}2026/10/aws-transit-gateway-cloud-wan-1-1-nat/`, + }, ]; /** Month-only dates sort after exact dates in the same month. */