Skip to content

Route

Source: src/AWS/EC2/Route.ts

A single route entry inside a RouteTable. A route maps a destination to exactly one target, telling the VPC where to send packets whose address falls within the destination range.

Every route has two halves:

  • Destination — exactly one of destinationCidrBlock (IPv4), destinationIpv6CidrBlock (IPv6), or destinationPrefixListId (a managed prefix list, e.g. for an AWS service).
  • Target — exactly one of gatewayId (internet/virtual private gateway), natGatewayId, instanceId (NAT instance), networkInterfaceId, vpcPeeringConnectionId, transitGatewayId, localGatewayId (Outposts), carrierGatewayId (Wavelength), egressOnlyInternetGatewayId (IPv6), coreNetworkArn (Cloud WAN), or vpcEndpointId (Gateway Load Balancer).

Changing the routeTableId or the destination replaces the route, whereas changing only the target is applied in place via ReplaceRoute.

IPv4 Routing

Section titled “IPv4 Routing”

Use an IPv4 destinationCidrBlock — most commonly 0.0.0.0/0 for the default route, or a narrower CIDR to route specific traffic.

Default Route to an Internet Gateway

const internetRoute = yield* AWS.EC2.Route("InternetRoute", {
  routeTableId: publicRouteTable.routeTableId,
  destinationCidrBlock: "0.0.0.0/0",
  gatewayId: internetGateway.internetGatewayId,
});

Sends all outbound IPv4 traffic to the internet gateway, which is what makes a subnet “public”. Attach this route table to any subnet that needs inbound and outbound internet connectivity.

Default Route to a NAT Gateway

const natRoute = yield* AWS.EC2.Route("NatRoute", {
  routeTableId: privateRouteTable.routeTableId,
  destinationCidrBlock: "0.0.0.0/0",
  natGatewayId: natGateway.natGatewayId,
});

Lets private subnets reach the internet for outbound traffic (package updates, API calls) while blocking unsolicited inbound connections. The NAT gateway itself lives in a public subnet.

Route to a VPC Peering Connection

const peeringRoute = yield* AWS.EC2.Route("PeeringRoute", {
  routeTableId: routeTable.routeTableId,
  destinationCidrBlock: "10.1.0.0/16",
  vpcPeeringConnectionId: "pcx-0abc1234",
});

Routes traffic destined for the peer VPC’s CIDR across a VPC peering connection. Use a narrow destination matching the remote VPC rather than 0.0.0.0/0 so only cross-VPC traffic is affected.

Route to a Transit Gateway

const transitRoute = yield* AWS.EC2.Route("TransitRoute", {
  routeTableId: routeTable.routeTableId,
  destinationCidrBlock: "172.16.0.0/12",
  transitGatewayId: "tgw-0abc1234",
});

Hands traffic to a transit gateway, the hub used to connect many VPCs and on-premises networks. The destination CIDR should cover the address space reachable through the transit gateway.

Route to a Network Interface or NAT Instance

const applianceRoute = yield* AWS.EC2.Route("ApplianceRoute", {
  routeTableId: routeTable.routeTableId,
  destinationCidrBlock: "0.0.0.0/0",
  networkInterfaceId: "eni-0abc1234",
});

Forwards traffic to a specific elastic network interface — for example a firewall or NAT instance appliance. Use instanceId instead when targeting a NAT instance that has exactly one network interface attached.

IPv6 Routing

Section titled “IPv6 Routing”

IPv6 routes use destinationIpv6CidrBlock (e.g. ::/0 for the IPv6 default route). For outbound-only IPv6 access from private subnets, target an EgressOnlyInternetGateway.

IPv6 Egress Route to an Egress-Only Internet Gateway

const ipv6EgressRoute = yield* AWS.EC2.Route("Ipv6EgressRoute", {
  routeTableId: privateRouteTable.routeTableId,
  destinationIpv6CidrBlock: "::/0",
  egressOnlyInternetGatewayId: egressOnlyIgw.egressOnlyInternetGatewayId,
});

Gives IPv6-addressed instances outbound internet access while blocking inbound connections — the IPv6 equivalent of routing IPv4 through a NAT gateway.

IPv6 Internet Route to an Internet Gateway

const ipv6InternetRoute = yield* AWS.EC2.Route("Ipv6InternetRoute", {
  routeTableId: publicRouteTable.routeTableId,
  destinationIpv6CidrBlock: "::/0",
  gatewayId: internetGateway.internetGatewayId,
});

Provides full bidirectional IPv6 connectivity for a public subnet, since an internet gateway (unlike an egress-only gateway) allows inbound IPv6 traffic.

Routing to AWS Services via Prefix Lists

Section titled “Routing to AWS Services via Prefix Lists”

Instead of a raw CIDR, a route can match a managed prefix list — useful for AWS service ranges (e.g. an S3 gateway endpoint) where the underlying CIDRs change over time.

const prefixListRoute = yield* AWS.EC2.Route("S3PrefixRoute", {
  routeTableId: privateRouteTable.routeTableId,
  destinationPrefixListId: "pl-0abc1234",
  vpcEndpointId: "vpce-0abc1234",
});

Routes traffic for every CIDR in the prefix list to a Gateway Load Balancer VPC endpoint. AWS keeps the prefix list current, so you don’t have to update the route when the service’s address ranges change.