AWS vpc: Document transit gateway route types including NAT system routes

Service: vpc · 2026-10-23 · Documentation low

File: vpc/latest/tgw/how-transit-gateways-work.md · Type: network

Summary

Adds a 'Route types' section describing static, propagated, and system routes, explains how 1:1 NAT installs system routes for VPC and Direct Connect/VPN attachments, and adds system routes to the route evaluation order.

Security assessment

The change documents routing behavior (static/propagated/system routes) and how NAT rules create system routes. It is networking configuration documentation with no direct authentication, encryption, or vulnerability content.

Evidence

+  * `system` – A route that the transit gateway installs. System routes are created by 1:1 NAT:

Diff

diff --git a/vpc/latest/tgw/how-transit-gateways-work.md b/vpc/latest/tgw/how-transit-gateways-work.md
index 0559e41..4da3f8a 100644
--- a//vpc/latest/tgw/how-transit-gateways-work.md
+++ b//vpc/latest/tgw/how-transit-gateways-work.md
@@ -120,0 +121,2 @@ For transit gateway peering attachments, only static routes are supported.
+  * Route types
+
@@ -157,0 +160,19 @@ When a static route and a propagated route have the same destination, the static
+### Route types
+
+A transit gateway route table can contain three types of routes:
+
+  * `static` – A route that you create in a transit gateway route table.
+
+  * `propagated` – A route learned from an attachment that propagates its routes to the route table.
+
+  * `system` – A route that the transit gateway installs. System routes are created by 1:1 NAT:
+
+    * For a VPC attachment, when a NAT rule's `MatchSourceCidr` exactly equals one of the VPC's CIDRs, a system route for the rule's `NatCidr` replaces the propagated route for that CIDR.
+
+    * For a Direct Connect gateway or BGP Site-to-Site VPN attachment with `NatSystemRouteSupport` enabled, the transit gateway adds a system route for each NAT CIDR, in addition to the routes your network advertises.
+
+
+
+
+System routes are installed only in route tables that the attachment propagates to. You can't modify or delete a system route directly. It's updated or removed when you change the attachment's NAT rules, disable `NatSystemRouteSupport`, or disable NAT. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html).
+
@@ -173,0 +195,2 @@ Transit gateway routes are evaluated in the following order:
+    * System routes (routes that the transit gateway installs for 1:1 NAT)
+