kanywst · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026
diff --git a/README.ja.md b/README.ja.md
@@ -32,7 +32,7 @@
 | 15 | 設計する | 質問に答えると推奨トポロジーと避けるべきパターン |
 | 16–18 | クイズ・年表・用語集 | 誤解か事実かカード、2009–2026 年のリリース、英日用語集 |
 
-すべての数字の根拠は [`docs/`](docs/README.md) (出典つき、英語) にあります。2026-10-10 時点の AWS 公式ドキュメント・What's New・Price List API で確認済み。
+すべての数字の根拠は [`docs/`](docs/README.md) (出典つき、英語) にあります。2026-10-10 時点の AWS 公式ドキュメント・What's New・Price List API で確認済み。料金・quota・新発表は 2026-11-09 に再確認。
 
 ## Direct Connect 深掘り
 
@@ -56,7 +56,7 @@
 | 年表 | 2011〜2026 年のリリース |
 | 用語集 | 各用語の英語・日本語の正式名と、混同しやすい用語 |
 
-深掘りページの内容は 2026-10-12 時点の AWS 公式ドキュメントで確認済み。
+深掘りページの内容は 2026-10-12 時点の AWS 公式ドキュメントで確認済み。料金・quota・ロケーション・SLA・新発表は 2026-11-09 に再確認。
 
 ## 開発
 

diff --git a/README.md b/README.md
@@ -32,7 +32,7 @@ Formerly `0-draft/on-ramp` (renamed 2026-11-08; the old site URL no longer serve
 | 15 | Plan yours | Questionnaire → recommended topology and anti-patterns |
 | 16–18 | Quiz, timeline, glossary | Myth-or-fact cards, launches 2009–2026, EN/JA glossary |
 
-The research behind every number lives in [`docs/`](docs/README.md), with sources. Facts were verified against AWS documentation, What's New posts and the AWS Price List API on 2026-10-10.
+The research behind every number lives in [`docs/`](docs/README.md), with sources. Facts were verified against AWS documentation, What's New posts and the AWS Price List API on 2026-10-10; prices, quotas and launches were re-checked on 2026-11-09.
 
 ## Direct Connect deep dive
 
@@ -56,7 +56,7 @@ The map is every road; the second page, **[Direct Connect, up close](https://0-d
 | Timeline | 2011–2026 launches |
 | Glossary | Every term with its official English and Japanese console name and what it is often confused with |
 
-Facts on the deep dive were verified against AWS documentation on 2026-10-12.
+Facts on the deep dive were verified against AWS documentation on 2026-10-12; prices, quotas, locations, the SLA and launches were re-checked on 2026-11-09.
 
 ## Development
 

diff --git a/docs/02-site-to-site-vpn.md b/docs/02-site-to-site-vpn.md
@@ -1,6 +1,6 @@
 # AWS Site-to-Site VPN
 
-This page covers AWS Site-to-Site VPN, the managed IPsec service that connects an on-premises network (data center, office, branch) to AWS over the internet or over Direct Connect. It covers where a VPN can terminate on the AWS side, the customer gateway, tunnels and routing, crypto options, bandwidth, acceleration, private IP VPN, IPv6, logging, route priority, quotas, pricing and the SLA. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Where AWS sources disagree with each other, the page says so instead of picking one silently.
+This page covers AWS Site-to-Site VPN, the managed IPsec service that connects an on-premises network (data center, office, branch) to AWS over the internet or over Direct Connect. It covers where a VPN can terminate on the AWS side, the customer gateway, tunnels and routing, crypto options, bandwidth, acceleration, private IP VPN, IPv6, logging, route priority, quotas, pricing and the SLA. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Where AWS sources disagree with each other, the page says so instead of picking one silently.
 
 ## At a glance
 

diff --git a/docs/03-sd-wan-and-connect.md b/docs/03-sd-wan-and-connect.md
@@ -1,6 +1,6 @@
 # SD-WAN, Connect attachments and self-managed overlays
 
-This page covers overlay paths between a corporate network and AWS that are not plain AWS Site-to-Site VPN: Transit Gateway Connect (GRE plus BGP), AWS Cloud WAN Connect attachments including Tunnel-less Connect, self-managed VPN or SD-WAN appliances on Amazon EC2 (strongSwan, AWS Marketplace NVAs), and where Gateway Load Balancer fits. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Managed IPsec VPN is covered in `02-site-to-site-vpn.md`.
+This page covers overlay paths between a corporate network and AWS that are not plain AWS Site-to-Site VPN: Transit Gateway Connect (GRE plus BGP), AWS Cloud WAN Connect attachments including Tunnel-less Connect, self-managed VPN or SD-WAN appliances on Amazon EC2 (strongSwan, AWS Marketplace NVAs), and where Gateway Load Balancer fits. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Managed IPsec VPN is covered in `02-site-to-site-vpn.md`.
 
 ## Why an overlay at all
 

diff --git a/docs/05-hubs.md b/docs/05-hubs.md
@@ -1,6 +1,6 @@
 # Where the on-prem path lands: AWS-side hubs
 
-This page covers what an on-prem connection (Direct Connect or Site-to-Site VPN) terminates on inside AWS and how routes get from there into VPCs: the virtual private gateway (VGW), the Direct Connect gateway (DXGW), AWS Transit Gateway (TGW) and AWS Cloud WAN. It explains VPC route tables and route propagation, TGW route tables, associations and propagations, Policy-Based Routing (2026), appliance mode, inspection with AWS Network Firewall and Gateway Load Balancer, TGW peering, multi-Region designs, sharing, quotas and prices including Tokyo. Path selection between overlapping routes is in [06-routing-and-path-selection.md](06-routing-and-path-selection.md). Verified against AWS documentation, What's New posts and the AWS Price List API as of 2026-10-10.
+This page covers what an on-prem connection (Direct Connect or Site-to-Site VPN) terminates on inside AWS and how routes get from there into VPCs: the virtual private gateway (VGW), the Direct Connect gateway (DXGW), AWS Transit Gateway (TGW) and AWS Cloud WAN. It explains VPC route tables and route propagation, TGW route tables, associations and propagations, Policy-Based Routing (2026), appliance mode, inspection with AWS Network Firewall and Gateway Load Balancer, TGW peering, multi-Region designs, sharing, quotas and prices including Tokyo. Path selection between overlapping routes is in [06-routing-and-path-selection.md](06-routing-and-path-selection.md). Verified against AWS documentation, What's New posts and the AWS Price List API as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09.
 
 ## The four hubs at a glance
 
@@ -102,7 +102,7 @@ flowchart LR
 - A static route with the same destination as a propagated route wins and hides the propagated one. Remove the static route and the propagated one reappears.
 - Blackhole routes drop matching traffic and are the standard way to isolate segments.
 - The TGW shows only the preferred route for a prefix. A backup (for example VPN behind DX) appears only after the preferred route is withdrawn.
-- If a new VPC has the same CIDR as an already attached VPC, its CIDR is not propagated. TGW cannot route between identical CIDRs.
+- If a new VPC has the same CIDR as an already attached VPC, its CIDR is not propagated. TGW cannot route between identical CIDRs; since 2026-10-23, 1:1 NAT on the attachment can map the overlapping side (or each side) to its own NAT CIDR ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)).
 
 ### Policy-Based Routing (GA 2026-07)
 
@@ -256,12 +256,13 @@ Worked example (Tokyo, own arithmetic): one TGW with 10 VPC attachments and one
 | 2025-11 | Cloud WAN in Thailand, Taipei and New Zealand |
 | 2026-04 | Client VPN native TGW attachment |
 | 2026-07 | TGW Policy-Based Routing (policy tables) |
+| 2026-10-23 | TGW and Cloud WAN 1:1 NAT on attachments (static, stateless CIDR-to-CIDR translation) |
 
 ## Common traps
 
 - A VPC does not learn on-prem routes from a TGW. You must add static routes (or a prefix list) in each subnet route table.
 - A subnet route to a TGW does nothing for an AZ where the TGW attachment has no subnet.
-- Two VPCs with identical CIDRs on one TGW: the second one silently does not propagate.
+- Two VPCs with identical CIDRs on one TGW: the second one silently does not propagate. Translate one with 1:1 NAT on its attachment (2026-10) or keep them apart.
 - TGW allowed prefixes on the DXGW must not overlap across TGWs on the same DXGW.
 - Forgetting appliance mode on the inspection VPC attachment breaks stateful firewalls only for cross-AZ flows, which makes it look intermittent.
 - A policy table on a VPN or Connect attachment silently stops BGP advertisements to that peer.
@@ -314,3 +315,4 @@ Worked example (Tokyo, own arithmetic): one TGW with 10 VPC attachments and one
 - <https://aws.amazon.com/blogs/networking-and-content-delivery/simplify-global-security-inspection-with-aws-cloud-wan-service-insertion/>
 - <https://aws.amazon.com/blogs/aws/inspect-subnet-to-subnet-traffic-with-amazon-vpc-more-specific-routing/>
 - <https://repost.aws/knowledge-center/vpn-troubleshoot-routing>
+- 1:1 NAT in AWS Transit Gateway (2026-10-23): <https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html> and <https://aws.amazon.com/about-aws/whats-new/2026/10/aws-transit-gateway-cloud-wan-1-1-nat/>
diff --git a/docs/06-routing-and-path-selection.md b/docs/06-routing-and-path-selection.md
@@ -170,7 +170,7 @@ AWS does not publish convergence times for propagation inside a VGW, TGW or Clou
 ## Overlapping CIDRs
 
 - On-prem range overlapping a VPC CIDR: the `local` route wins, so that on-prem range is unreachable from the VPC. Renumber or translate (for example with a private NAT gateway).
-- Two VPCs with identical CIDRs on one TGW: the second VPC's CIDR is not propagated. TGW cannot route between identical CIDRs.
+- Two VPCs with identical CIDRs on one TGW: the second VPC's CIDR is not propagated. TGW cannot route between identical CIDRs. Since 2026-10-23, 1:1 NAT on the TGW attachment maps an original CIDR to a NAT CIDR of the same length, in both directions and without connection state. On TGW: VPC, Direct Connect gateway, Site-to-Site VPN (including Private IP VPN), Connect, peering and VPN Concentrator attachments; not Client VPN; IPv4 only; not on a VPC attachment with appliance mode ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)).
 - VGW associations on one DXGW need non-overlapping VPC CIDRs.
 - Allowed prefixes for different TGWs on one DXGW must not overlap.
 - Overlapping but not identical prefixes are fine everywhere; longest prefix match decides.
@@ -316,3 +316,4 @@ DX_EDGE(dst) for private/transit VIFs:
 - <https://repost.aws/knowledge-center/vpn-bgp-logs-troubleshoot-tunnel>
 - [direct-connect/06-bgp-and-routing.md](direct-connect/06-bgp-and-routing.md)
 - [direct-connect/07-resiliency.md](direct-connect/07-resiliency.md)
+- 1:1 NAT in AWS Transit Gateway (2026-10-23): <https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html> and <https://aws.amazon.com/about-aws/whats-new/2026/10/aws-transit-gateway-cloud-wan-1-1-nat/>
diff --git a/docs/07-user-access.md b/docs/07-user-access.md
@@ -1,6 +1,6 @@
 # User and device access to AWS
 
-This page covers the paths that connect people and their devices (laptops, admin workstations, contractors) to resources in AWS, as opposed to site-to-site paths that connect whole networks. It covers AWS Client VPN, AWS Verified Access, AWS Systems Manager Session Manager, EC2 Instance Connect Endpoint, the "bring the user to AWS" services (Amazon WorkSpaces, Amazon WorkSpaces Applications formerly AppStream 2.0, Amazon WorkSpaces Secure Browser), classic bastion hosts, and how a corporate identity provider (IdP) ties in. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Where something could not be verified, the page says so.
+This page covers the paths that connect people and their devices (laptops, admin workstations, contractors) to resources in AWS, as opposed to site-to-site paths that connect whole networks. It covers AWS Client VPN, AWS Verified Access, AWS Systems Manager Session Manager, EC2 Instance Connect Endpoint, the "bring the user to AWS" services (Amazon WorkSpaces, Amazon WorkSpaces Applications formerly AppStream 2.0, Amazon WorkSpaces Secure Browser), classic bastion hosts, and how a corporate identity provider (IdP) ties in. Every number was checked against AWS documentation, What's New posts, the AWS Price List API and AWS blogs, verified as of 2026-10-10. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Where something could not be verified, the page says so.
 
 ## At a glance
 

diff --git a/docs/09-private-service-access.md b/docs/09-private-service-access.md
@@ -1,6 +1,6 @@
 # Private access to AWS services and SaaS from on-premises
 
-This page covers how a corporate network (data center, office, branch) reaches AWS *service APIs* (S3, DynamoDB, KMS, ECR, STS, ...) and third-party SaaS without the public internet, and the reverse: how AWS workloads reach on-premises services privately. It assumes you already have a Direct Connect (DX) or Site-to-Site VPN path into a VPC (see the earlier pages); here the question is what sits at the AWS end of that path and how the names resolve to it. Verified as of 2026-10-10 against AWS documentation, What's New posts, the AWS Price List API and AWS blogs. Prices are USD for Asia Pacific (Tokyo, `ap-northeast-1`) unless stated.
+This page covers how a corporate network (data center, office, branch) reaches AWS *service APIs* (S3, DynamoDB, KMS, ECR, STS, ...) and third-party SaaS without the public internet, and the reverse: how AWS workloads reach on-premises services privately. It assumes you already have a Direct Connect (DX) or Site-to-Site VPN path into a VPC (see the earlier pages); here the question is what sits at the AWS end of that path and how the names resolve to it. Verified as of 2026-10-10 against AWS documentation, What's New posts, the AWS Price List API and AWS blogs. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Prices are USD for Asia Pacific (Tokyo, `ap-northeast-1`) unless stated.
 
 ## The one rule that explains everything
 

diff --git a/docs/10-hybrid-dns.md b/docs/10-hybrid-dns.md
@@ -1,6 +1,6 @@
 # Hybrid DNS: Route 53 VPC Resolver, endpoints, rules and Profiles
 
-A private path is useless if the name resolves to the wrong address: an on-prem host that resolves `s3.ap-northeast-1.amazonaws.com` to a public IP will ignore your interface endpoint, and an EC2 instance that cannot resolve `corp.example.com` will never use your Direct Connect. This page covers Route 53 VPC Resolver (renamed from "Route 53 Resolver" in November 2025), inbound and outbound Resolver endpoints, forwarding/system/delegation rules, sharing via AWS RAM and Route 53 Profiles, private hosted zones, DNS Firewall, query logging, Resolver on Outposts, DNS over HTTPS, and the newer Global Resolver. Verified as of 2026-10-10 against Route 53 documentation, What's New posts, AWS blogs and the AWS Price List API. Prices are USD for Asia Pacific (Tokyo) unless stated.
+A private path is useless if the name resolves to the wrong address: an on-prem host that resolves `s3.ap-northeast-1.amazonaws.com` to a public IP will ignore your interface endpoint, and an EC2 instance that cannot resolve `corp.example.com` will never use your Direct Connect. This page covers Route 53 VPC Resolver (renamed from "Route 53 Resolver" in November 2025), inbound and outbound Resolver endpoints, forwarding/system/delegation rules, sharing via AWS RAM and Route 53 Profiles, private hosted zones, DNS Firewall, query logging, Resolver on Outposts, DNS over HTTPS, and the newer Global Resolver. Verified as of 2026-10-10 against Route 53 documentation, What's New posts, AWS blogs and the AWS Price List API. Prices and quotas re-checked against the AWS Price List API and AWS documentation on 2026-11-09. Prices are USD for Asia Pacific (Tokyo) unless stated.
 
 ## The building blocks
 

diff --git a/docs/12-security-and-operations.md b/docs/12-security-and-operations.md
@@ -32,11 +32,12 @@ VPC Encryption Controls (launched 2025-11, paid from 2026-03-01, declarative org
 | Private NAT + ALB/NLB in the other network | SNAT on one side, load balancer as DNAT on the other | Both, per service | NAT + LB charges |
 | PrivateLink (NLB endpoint service) | Consumers get an endpoint IP in their own CIDR; overlap is irrelevant | Consumer → service | Endpoint $0.014/h per AZ + $0.01/GB |
 | PrivateLink tunnel endpoints (2026-09) | Share a resource configuration that represents a whole CIDR range via RAM; the consumer reaches it with GENEVE-encapsulated tunnel endpoint | Consumer → network segment | $0.028/h + $0.01/GB (first PB) |
+| TGW / Cloud WAN 1:1 NAT (2026-10-23) | A per-attachment rule maps an original CIDR to a NAT CIDR of the same prefix length; static and stateless, host bits kept, both directions. On TGW: VPC, Direct Connect gateway, Site-to-Site VPN (including Private IP VPN), Connect, peering and VPN Concentrator attachments; not Client VPN; IPv4 only; not on a VPC attachment with appliance mode ([TGW user guide](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html)) | Both | Not checked (see Amazon VPC pricing) |
 | Outposts CoIP | LGW 1:1 NATs Outpost instances to an on-prem-owned pool | Both | Included in Outposts |
 | NAT on the customer router / firewall | Translate on-prem side before it reaches AWS | Either | Your equipment |
 | IPv6 | Global unique addressing removes the overlap problem | Both | — |
 
-Transit Gateway and VPC peering cannot route between identical CIDRs; one side has to be translated or hidden behind an endpoint.
+Transit Gateway and VPC peering cannot route between identical CIDRs; one side has to be translated or hidden behind an endpoint. Since 2026-10-23 the translation can happen on the TGW or Cloud WAN attachment itself (1:1 NAT), with no NAT gateway or appliance to run.
 
 ## IPv6 on each path
 
@@ -249,3 +250,4 @@ The per-GB saving of DX over internet in Tokyo is 0.114 − 0.041 = $0.073/GB in
 - <https://aws.amazon.com/about-aws/whats-new/2026/07/vpc-encryption-controls-declarative-controls/>
 - <https://aws.amazon.com/about-aws/whats-new/2026/9/privatelink-tunnel-endpoint/>
 - AWS Price List API offer files for ap-northeast-1 (AmazonVPC, AmazonEC2, AWSDataTransfer, AWSDirectConnect, AWSCloudWAN, AmazonCloudWatch, AWSDataSync, AWSTransfer), fetched 2026-10-10: <https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/index.json>
+- 1:1 NAT in AWS Transit Gateway (2026-10-23): <https://docs.aws.amazon.com/vpc/latest/tgw/tgw-nat.html> and <https://aws.amazon.com/about-aws/whats-new/2026/10/aws-transit-gateway-cloud-wan-1-1-nat/>