Cloud WAN's segments cut cross-region inspection from two firewall hops to one

A full mesh across four regions is six peering relationships: 4 times 3, halved. Add a fifth region and it becomes ten, so the region you turn on next quarter brings four new peerings with it ^[1][2].

Most of the recurring work is per VPC. In the Transit Gateway pattern, each new VPC means an attachment, a route table association, propagation into the right tables, and often a static route or two, and every new environment or partner multiplies that ^[3]. In Cloud WAN, the attachment lands in a segment, and the segment exists on every edge. A VPC attached in Sydney has its CIDR learned by the edges in Virginia and Oregon without anyone editing a route ^[5][6]. The post puts it this way: "If Transit Gateway is a router you configure, Cloud WAN is a WAN you describe" ^[8].

The second complaint is about where intent lives. The sentence the author says no document holds is "test can reach shared services, and nothing else". In the mesh that intent exists only as route tables in four regions, and you prove it by reading all of them ^[4]. In the policy, the shared services hub reaching into each environment is two-way and never transitive ^[10].

Inspection is the part that happens twice. A stateful firewall has to see both directions of a flow. With independent regional gateways, the only way to guarantee symmetry is to inspect leaving the source region and again entering the destination region ^[11]. In the Cloud WAN design, the two production flows to another cloud are inspected once each and exit through the nearest Direct Connect landing ^[12]. The author writes that Cloud WAN removes both problems and that this is the reason to adopt it ^[18]. The post describes itself as a design guide, not a tutorial, and it leaves out pricing and hours-spent figures ^[19].

The design still needs per-region plumbing. An edge has no internet gateway and no firewall of its own. Anything that needs either has to be a VPC you attach ^[13]. Here every VPC drains to its region's inspection VPC, which holds the NAT and the internet gateway ^[14]. The post calls an edge "a router you never see", and AWS operates it ^[17]. Region affinity is the default: traffic stays in its home region wherever it can, and crosses the backbone only when the destination or the policy says so. Concentrating inspection or egress in one region is an override you write on purpose ^[16]. Each edge also needs its own ASN, reserved from a private range in the policy ^[15].