This is something that is generally easy with physical routers, but I can’t figure out how to do it in AWS.

I have a kubernetes cluster that is in its own VPN using 10.0.0.0/16 addresses.

Our corporate network uses the 172.16.0.0/12 CIDR. And I have a Site-to-Site VPN up and running that terminates in a transit gateway.

We have allocated 172.30.0.0/16 to AWS resources to allow routing to/from AWS over the VPN/TGW.

My issue is how to allow the 10.0.0.0/16 kubernetes cluster to send traffic over the VPN to access corporate resources.

The AWS help seems to always rely on having a single VPN that has 2 subnets that straddle the NAT you want to do. Basically you put your NATGW in the routable subnet so that it has a routable IP and then you create a route in your non-routable subnet to the NATGW. That makes sense to me.

However, AWS VPC CIDR Association Limitations states that you can not have a single VPC that has subnets that fall within more than one of the RFC 1918 Private CIDRs, meaning that I can’t follow the suggested pattern because I would have to have a 10.x subnet and a 172.16 subnet both in the same VPC.

How can I accomplish this NAT?