AWSTemplateFormatVersion: '2010-09-09'
Description: Transit Gateway core - spoke, inspection, and egress route tables (deploy first)

Parameters:
  TgwName:
    Type: String
    Default: egress-fw-tgw

Resources:
  TransitGateway:
    Type: AWS::EC2::TransitGateway
    Properties:
      Description: Centralized inspection and egress Transit Gateway
      AmazonSideAsn: 64512
      AutoAcceptSharedAttachments: disable
      DefaultRouteTableAssociation: disable
      DefaultRouteTablePropagation: disable
      DnsSupport: enable
      VpnEcmpSupport: enable
      Tags:
        - Key: Name
          Value: !Ref TgwName

  SpokeRouteTable:
    Type: AWS::EC2::TransitGatewayRouteTable
    Properties:
      TransitGatewayId: !Ref TransitGateway
      Tags:
        - Key: Name
          Value: !Sub '${TgwName}-spoke-rt'

  InspectionRouteTable:
    Type: AWS::EC2::TransitGatewayRouteTable
    Properties:
      TransitGatewayId: !Ref TransitGateway
      Tags:
        - Key: Name
          Value: !Sub '${TgwName}-inspection-rt'

  EgressRouteTable:
    Type: AWS::EC2::TransitGatewayRouteTable
    Properties:
      TransitGatewayId: !Ref TransitGateway
      Tags:
        - Key: Name
          Value: !Sub '${TgwName}-egress-rt'

Outputs:
  TransitGatewayId:
    Description: Transit Gateway ID
    Value: !Ref TransitGateway
    Export:
      Name: !Sub '${AWS::StackName}-TGW-ID'

  SpokeRouteTableId:
    Description: TGW route table for spoke VPC attachments
    Value: !Ref SpokeRouteTable
    Export:
      Name: !Sub '${AWS::StackName}-SPOKE-RT'

  InspectionRouteTableId:
    Description: TGW route table for inspection VPC attachment
    Value: !Ref InspectionRouteTable
    Export:
      Name: !Sub '${AWS::StackName}-INSPECTION-RT'

  EgressRouteTableId:
    Description: TGW route table for egress VPC attachment
    Value: !Ref EgressRouteTable
    Export:
      Name: !Sub '${AWS::StackName}-EGRESS-RT'