@AlexEsibov , we don't allow any outbound traffic from our VPC/subnets. By default, any cluster's we spin up don't have ability to talk to internet. If it needs internet connectivity, we set proxy thru init script of the cluster. 

In route table, the traffic for internet is routed to TGW and from their it routes to proxy. How does it works in our case?