Connecting AWS GovCloud to External Cloud Vendors (No Gov Presence)

How I connected AWS GovCloud to external Cloud [ services in a dedicated network not open to public ] via Commercial AWS VPC & TGW Peering with S2S VPN tunnel.

When any external cloud vendor doesn’t operate in AWS GovCloud, and your workloads in GovCloud need to talk to those external services — things get tricky. But here’s how we can do it cleanly and securely using AWS Transit Gateway (TGW) Peering and Commercial AWS as a bridge.

GovCloud has physical and logical (network) isolation from the rest of the regions for compliance reasons , so native solutions like VPC peering or TGW attachments aren’t available. You can implement S2S [ site-to-site ] VPN over the Internet to establish connectivity.

This approach connects a GovCloud VPC via VGW to a Commercial AWS TGW [ Owned by us ], which can then route to an external cloud (e.g., via peered TGWs or other VPNs).

🧱Prerequisites

• GovCloud VPC with VGW
• Commercial AWS account with Transit Gateway (TGW)
• Static routing only (no BGP)
• 2 tunnel setup using manually shared PSKs

Architecture Summary:

[ GovCloud VPC ]
       |
     (VGW)
       |
   [ Site-to-Site VPN Tunnel ]
       |
[ Commercial AWS VPC ]
       |
     (TGW)
       |
[ TGW Peering Attachment ]
       |
[ External Vendor's AWS Network ]
     (Private GW or TGW)
       |
[ Vendor Services / APIs ]

Flow Summary:

GovCloud VPC connects to a VGW.

VGW ↔ VPN Tunnel ↔ TGW in Commercial AWS.

That TGW is peered with the external vendor’s PGW/TGW.

Apps in GovCloud can now reach vendor services via transit through 
Commercial AWS.

Steps

Step 1. In GovCloud AWS Account — Create CGW, VGW, and VPN

1. Create a VGW and attach it to the GovCloud VPC.

2. Create a CGW in GovCloud (use a placeholder IP like 1.1.1.1).

3. Create Site-to-Site VPN connection, any custom values per your network policies.

4. Attach to the VGW.

5. Use static routing.

6. Enter the CIDR of the vendor’s network.

Note down:

Tunnel Outside IPs

Pre-Shared Keys (PSKs)

Step 2: TGW Peering to Vendor (Using Shared TGW via Resource Access Manager)

When an external cloud vendor shares their Transit Gateway (TGW) with you using AWS Resource Access Manager (RAM), here’s what to do:

✅ 1. Accept the RAM Share Vendor shares their TGW (and optionally their TGW route table) via RAM:

You’ll get access to the TGW ARN, such as: arn:aws:ec2:us-east-1:xxxxxxxxxx:transit-gateway/tgw-xxxxxxx

Go to AWS RAM → Shared with me and accept the shared resource.

✅ 2. Create TGW Peering Attachment (from your Commercial AWS TGW)

aws ec2 create-transit-gateway-peering-attachment \
 - transit-gateway-id <your-commercial-tgw-id> \
 - peer-transit-gateway-id <shared-tgw-id> \
 - peer-region us-east-1 \
 - region <your-commercial-region>

aws ec2 create-transit-gateway-peering-attachment \ — transit-gateway-id <your-commercial-tgw-id> \ — peer-transit-gateway-id <shared-tgw-id> \ — peer-region us-east-1 \ — region <your-commercial-region> ⚠️ Important: Use the TGW ID, not just the ARN. The peer account ID may be omitted if the TGW is RAM-shared.

✅ 3. Vendor Accepts the Peering The vendor accepts the peering on their side.

Once accepted, the peering status changes to Available.

✅ 4. Vendor’s VPC Becomes Reachable You’ll now see a new TGW Attachment in your TGW console.

It will show resource type = “Peering”, but in many cases like this, you’ll also see the vendor’s VPC ID, subnets and CIDR reflected — even though you didn’t attach it directly.

✅ 5. Route Vendor CIDRs via the Peering Attachment In your TGW route table:

aws ec2 create-transit-gateway-route \
 — destination-cidr-block <Vendor C \
 — transit-gateway-route-table-id <your-tgw-rtb-id> \
 — transit-gateway-attachment-id <vendor-peering-attachment-id>

✅ Now your Commercial TGW can route traffic to the vendor’s VPC, and since GovCloud is already connected via VPN, you just need to route GovCloud CIDRs accordingly (Step 5).

TGW attachment and TGW CIDR block is vendor’s CIDR

Under TGW routing table, in associations you should see —

Resource type “peering” and Under “propagations” the resource ID will have the VPC of the external vendors.

Under “Routes” — Vendor CIDR and TGW details and resource type VPC and route type “propagated”.

Step 3: In Commercial AWS — Create TGW and VPN

1. Create a Customer Gateway (CGW) in Commercial using GovCloud tunnel’s Outside IP (Tunnel 1).

2. Create a Site-to-Site VPN connection in Commercial:

3. Attach to the Transit Gateway created in step 2.

4. Use static routing (no CIDRs entered here — handled in TGW Route Table).

5. In Tunnel Options:

Set Startup Action = Start

Use same PSK as GovCloud Tunnel 1

Enter Gov’s Tunnel Outside IP as remote.

No static route as attached to the TGW not VGW

Step 4: Modify GovCloud VPN with Correct Tunnel IP

1.Now that Commercial-side VPN is created:

Edit GovCloud’s VPN

Update the Customer Gateway [ creating a new one ] with the correct Tunnel 1 Outside IP from Commercial VPN.

Modify the the VPN tunnel connection to choose the new CGW.

In tunnel options:

Set Startup Action = Start

Ensure PSKs match

2. ✅ Tunnel 1 should come UP in ~5–15 mins on Gov side, then on Commercial side.

3. Repeat the process for Tunnel 2 (swap outside IPs, reuse Gov PSK in Commercial).

Step 5: Attachments and Route Tables

1. Attach your Commercial VPC to TGW (if not already).
2. In TGW Route Tables (Commercial):
3. Add static route for GovCloud VPC CIDR, target = VPN attachment
4. Under “Routes” — GOV CIDR and TGW details, Resource ID as VPN with outside IP and resource type as VPN and route type “static”.

1. In GovCloud VPC Route Table:
2. Add static route for Vendor CIDR, target = VGW

Step 6: Security & DNS

1. Ensure Security Groups and NACLs allow communication end-to-end.
2. For Private DNS/VPC Endpoints:
3. Use Route 53 forwarding rules, or
4. Run CoreDNS to rewrite vendor DNS if necessary

Wrap-Up

Similar to this, have connected to various external cloud vendors, AWS to Azure, AWS to oracle Cloud, AWS to Cisco ASA via VPN tunnel.

Hope this helped — and good luck building yours.