AWS Builder Center

Builder Center

Designing a Global Enterprise Network Fabric: The Kiro Fabric Architecture

Designing a Global Enterprise Network Fabric: The Kiro Fabric Architecture

Design a high-performance global network with the Kiro fabric. This reference architecture explores building a resilient multi-region infrastructure using AWS Direct Connect (BFD-tuned), Transit Gateway, and Global Accelerator. Learn to achieve 900ms hybrid failovers and automated symmetric security via GWLB. Backed by 30-day production staging metrics, we dive into critical lessons on TGW Appliance Mode, route propagation complexity, and high-fidelity observability using VPC Flow Logs v5.

Binod Prasad Joshi

AWS Community Builder - Dev Tools | 2× AWS Certified | Devops/Cloud Consultant
When scaling enterprise systems, network architecture often becomes the ultimate bottleneck. Large organizations frequently struggle with unpredictable wide-area network (WAN) failures, stateful firewall routing asymmetry, global edge latency, and visibility blind spots across hybrid environments.
To solve these challenges at scale, our engineering team designed Kiro.

What is Kiro?

Kiro is an internal reference architecture and blueprint for a custom network fabric. It combines AWS native networking primitives with strict traffic engineering policies to serve as a unified transit and delivery engine. It is entirely distinct from the AWS Kiro AI IDE.
This post details how we built the Kiro fabric to achieve sub-second hybrid link failovers, automated symmetric security inspection, and high-performance multi-region edge routing.

High-Level System Architecture


Architectural Outcomes & Metrics
The following metrics represent performance differentials captured during a 30-day production staging evaluation, comparing our legacy hub-and-spoke configuration against the Kiro network fabric topology:
Metric
Baseline Architecture
Kiro Network Fabric
Hybrid Link Failover Time
90 seconds (Standard BGP)
900 milliseconds (BFD Tuned)
Cross-Region Dynamic Failover
15 minutes (Manual/DNS TTL bound)
28 seconds (Anycast Rerouting)
Global Edge Cache Hit Ratio (CHR)
72.0%
94.2% (Origin Shield Opt.)
Origin Compute Load Reduction
Baseline Layer
65% decrease
Note: The measured 28-second failover time includes endpoint health-check detection, Global Accelerator endpoint withdrawal, and client connection re-establishment during testing.
1. Multi-Region Hybrid Transit & High-Availability Core
The core of the Kiro fabric handles connectivity between on-premises data centers and a distributed, multi-region AWS environment anchored in  us-east-1  and  us-west-2 .
Multi-Region Transit Gateways
The architecture utilizes regional AWS Transit Gateways (TGW) interconnected via Inter-Region Peering. Because TGW peering is strictly non-transitive, routes must be explicitly propagated and targeted within each regional TGW route table to prevent isolation blocks and ensure deterministic path selection across regions.
Ultra-Low Latency Direct Connect Failover
Standard BGP keepalive timers (30s interval/90s hold) introduce unacceptable latency during infrastructure disruptions. Kiro implements Bidirectional Forwarding Detection (BFD) on top of AWS Direct Connect (DX) to achieve sub-second convergence at the physical layer.
  • BFD Configuration: Min Rx/Tx Interval set to  300ms  with a Multiplier of 3 , driving failure detection down to 900ms.
  • Layer 2 Security: Traffic is secured at line-rate over dedicated 10Gbps/100Gbps physical interconnects using IEEE 802.1AE MACsec, bypassing the CPU and MTU overhead of Layer 3 IPsec VPNs.
plaintext
! On-Premises Core Router BGP & BFD Configuration
interface TenGigabitEthernet0/1/0
 description Primary Interconnect to AWS DX Location 1
 ip address 192.168.10.2 255.255.255.252
 bfd interval 300 min_rx 300 multiplier 3
!
router bgp 65500
 neighbor 192.168.10.1 remote-as 7224
 neighbor 192.168.10.1 fall-over bfd
 neighbor 192.168.10.1 route-map KIRO_OUTBOUND out
2. Centralized Symmetric Security Inspection
Enterprise compliance dictates that all traffic moving inter-VPC, inbound from the internet, or outbound to hybrid destinations must undergo deep packet inspection (DPI).
Inline Inspection Layer via GWLB
Kiro implements a centralized inspection topology using AWS Gateway Load Balancer (GWLB) and third-party firewall appliances inside a dedicated Security VPC.

  • GENEVE Protocol (UDP Port 6081): GWLB encapsulates the original Layer 3 IP packet inside a GENEVE header. This preserves the client's original source IP, destination IP, and protocol flags. Firewalls can perform deep inspection without requiring source NAT (SNAT).
  • TGW Appliance Mode: Stateful firewalls require symmetric traffic paths (the request and response must hit the same appliance instance). Enabling Appliance Mode on the Transit Gateway VPC attachments forces traffic crossing Availability Zones to maintain flow alignment to the same appliance instance.
3. Global Content Delivery & Edge Routing
At the outer edge, Kiro optimizes application delivery through a multi-tier caching and Global Anycast layer.
Global Anycast and Traffic Redirection
Instead of relying solely on Route 53 DNS latency routing, which is bounded by client-side DNS Time-to-Live (TTL) caching compliance, the fabric deploys AWS Global Accelerator.
This provisions static, global Anycast IP addresses. Traffic enters the AWS global network backbone at the Edge Location closest to the user. If an entire AWS region experiences a critical outage, Global Accelerator handles rapid endpoint failover and connection re-establishment, redirecting new client connection paths to the healthy standby region via Anycast BGP routing in under 30 seconds.
Multi-Tier Edge Compute & Optimization
To maximize edge performance, Kiro separates concerns cleanly across the CDN layer:
  1. CloudFront Origin Shield: Actively deployed in high-density regional caches to protect origins against request replication spikes, consolidating cache misses into a single request stream to backends.
  1. Edge Processing Split:
  • CloudFront Response Headers Policy: Where customization requirements are minimal, native Response Headers Policies are used to inject security compliance flags like HTTP Strict Transport Security (HSTS) into the viewer response flow without requiring custom compute execution.
  • CloudFront Functions / Lambda@Edge: Used only for specialized payload modification or origin requests. To prevent latency penalties and cold starts, Lambda@Edge never queries a remote database directly. Instead, tokens are verified cryptographically via local JSON Web Tokens (JWT) using cached public keys.
JavaScript
// CloudFront Function: Custom Request Handler (URL Normalization Case)
function handler(event) {
    var request = event.request;
    
    // Enforce lowercase structure before cache validation
    request.uri = request.uri.toLowerCase();
    
    return request;
}
4. High-Fidelity Observability
A network fabric is only as dependable as its telemetry. Kiro moves past basic 5-tuple metrics by leveraging VPC Flow Logs (Version 5) to extract deep transport-layer metadata.
JSON
{
  "version": "5",
  "account-id": "111122223333",
  "interface-id": "eni-0123456789abcdef0",
  "srcaddr": "10.0.1.45",
  "dstaddr": "192.168.10.4",
  "srcport": "443",
  "dstport": "52341",
  "protocol": "6",
  "packets": "1420",
  "bytes": "213000",
  "action": "ACCEPT",
  "tcp-flags": "18", 
  "traffic-path": "8",
  "pkt-srcaddr": "93.184.216.34",
  "pkt-dstaddr": "10.0.1.45"
}
Deciphering the Metadata Fields:
  •  tcp-flags : Captured flow metadata (such as a value of  18  representing  SYN-ACK ) can be correlated with application and Application Load Balancer (ALB) telemetry to identify failed, timed-out, or incomplete TCP handshakes across the fabric.
  •  traffic-path : A value of  8  indicates traffic traversed a Transit Gateway VPC attachment, giving immediate visibility into intra-fabric transit hops.
  •  pkt-srcaddr : This field exposes the true, original client source IP packet entry ( 93.184.216.34 ) before passing through intermediate NAT layers, significantly reducing troubleshooting and threat hunting times.
5. Operational Trade-offs & Route Complexity
Designing a high-tier enterprise platform requires balancing raw network benefits against real operational overhead.
Financial and Component Trade-offs
Component
Architecture Benefit
Financial / Complexity Cost
Direct Connect
Fixed ultra-low latency, line-rate L2 MACsec encryption.
High fixed monthly cross-connect fees and physical port recurring costs.
TGW Peering
Clean, centralized inter-region multi-VPC transit mesh.
Inter-region data transfer charges ($/GB) and non-transitive route tracking.
Global Accelerator
Sub-30s Anycast failover; public internet bypass.
Fixed hourly provisioning fees per accelerator + Data Transfer-Premium charges.
GWLB Layer
Scale-out security automation with preserved source IPs.
Hourly endpoint provisioning costs + firewall appliance software licenses.
Routing Hierarchy Complexity
The primary operational challenge of the Kiro fabric lies in maintaining deterministic route propagation across isolated routing domains. To keep traffic flowing symmetrically through the firewall pool without introducing loops, four overlapping route domains must be tightly orchestrated:
  1. TGW Route Tables: Separated to isolate Production and Inspection domains.
  1. VPC Route Tables: Pointing subnet traffic paths directly to local GWLB endpoints.
  1. Ingress Route Tables: Associated with Internet Gateways to intercept and steer public traffic.
  1. GWLBe Subnet Route Tables: Ensuring post-inspection traffic propagates correctly to internal destination subnets.
6. Failure Scenario Walkthrough
To evaluate the resilience of the Kiro design, we run continuous automated chaos simulation tests. The blueprint reacts deterministically to unexpected physical infrastructure drops:
Scenario: Primary Direct Connect Fiber Disruption

  1. The Outage: A backend physical fiber cut completely disrupts the primary path between the on-premises core router and AWS DX Location 1.
  1. Sub-Second Detection: Because BFD keepalive parameters are tuned to 300ms intervals, missing exactly 3 consecutive verification packets causes the local hardware router to declare the path dead within 900 milliseconds.
  1. BGP Convergence: Rather than waiting for the standard 90-second BGP hold timer to expire, the system triggers immediate session teardown.
  1. Dynamic Rerouting: Inbound and outbound traffic immediately pivots to the pre-established backup path via DX Location 2. Active TCP connection states continue moving along the alternative route with zero session drops.
Summary
By unifying predictable physical link configurations, strictly enforced symmetric firewall tracking via GWLB, and a resilient multi-region Anycast routing layer, the Kiro reference architecture delivers a blueprint for reliable global enterprise connectivity.
What specific details should we map out next? We can deep-dive into the automated CI/CD pipelines used to validate route symmetry before pushing changes live, or configure the ingress routing tables for the Internet Gateway (IGW) to automate public-to-GWLB traffic redirection.


# networking-content-delivery# aws-transit-gateway# aws-global-accelerator# security-and-compliance# architecture
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article