Best multi-cloud networking for secure service-to-service?

When designing secure service-to-service communication across multiple clouds (AWS, Azure, GCP, on-prem), the "best" approach shifts away from traditional Layer 3/4 perimeter networking (like complex VPN meshes) and moves toward Layer 7 Service Meshes combined with Cloud-Native Backbone Routing.

The top architectures and tools depend on whether you want an application-layer solution or a network-layer transit solution.

1. The Gold Standard for L7 Security: Multi-Cluster Service Mesh

For true service-to-service security (mutual TLS, fine-grained access control, and identity-based policies), a multi-primary or primary-remote service mesh is the most robust approach.

• Istio (Multi-Network / Multi-Primary): Istio is widely considered the industry leader for cross-cloud service meshes. By configuring a multi-network Istio mesh, services in AWS and GCP can securely communicate via mTLS with automatic identity federation (using SPIFFE/SPIRE). It abstracts the underlying cloud network entirely.
• Consul (HashiCorp): Consul offers robust multi-datacenter and multi-cloud service-to-service connectivity via Connect. It is often favored if you have a heavy mix of legacy VMs alongside Kubernetes clusters, as its non-Kubernetes integration is smoother than Istio's.

2. The Gold Standard for L3/4 Transport & Backbone: Cloud-Agnostic Transit + SDN

If your primary hurdle is getting secure, high-performance, predictable private transport between clouds before applying application-layer policies:

• Cisco Multicloud Defense / Catalyst SD-WAN: Excellent for enterprise control, letting you enforce consistent security inspection and segmentation policies as traffic traverses cloud boundaries.
• F5 Distributed Cloud Services (formerly Volterra): Provides a "Secure Mesh" architecture that spans edge, private, and multiple public clouds, effectively creating a unified virtual private network with integrated L7 web app and API security.
• Native Hyperscaler Interconnects (e.g., Google Cloud Cross-Cloud Network + AWS Interconnect): Hyperscalers are increasingly offering direct, streamlined backbone partnerships to bypass public internet routing and simplify BGP/IPsec overhead.

Summary Recommendation

• Choose Istio (Multi-Primary on Multi-Network) if your workloads are heavily containerized/Kubernetes-based and your priority is zero-trust, application-level identity (mTLS) and telemetry across clouds.
• Choose F5 Distributed Cloud or Aviatrix if you need a unified networking and security transit layer that handles both Kubernetes and traditional VM workloads with simple multi-cloud routing policies.

To help narrow down the ideal stack for your environment, tell me:

• Are your cross-cloud services running primarily on Kubernetes (EKS, GKE, AKS) or a mix of VMs and containers?
• Do you require strict data residency/compliance constraints on the transit path?

If you mean secure service-to-service communication across AWS/Azure/GCP, my default recommendation is a two-layer architecture:

1. Private multi-cloud transport: use native private connectivity or a managed multicloud network.
2. Service-level security: use a service mesh / identity layer for mTLS, authorization, and service discovery.

My picks

For example, AWS's current Interconnect–multicloud provides managed private Layer-3 connectivity; as of April 2026, AWS lists Google Cloud as the launch partner, with Azure and OCI coming later in 2026.

Architecture I'd use

                 ┌───────────────┐
                 │ Service Mesh  │
                 │ mTLS + AuthZ  │
                 └───────┬───────┘
                         │
       ┌─────────────────┼─────────────────┐
       │                 │                 │
   AWS VPC            GCP VPC           Azure VNet
       │                 │                 │
   K8s/EKS            K8s/GKE           K8s/AKS
       │                 │                 │
       └──── Private encrypted backbone ───┘
                  BGP / routing

The important distinction is that private networking alone doesn't give you service-level security. A private AWS↔GCP link can still allow overly broad network access. Put workload identity + mTLS + authorization policies above it.

For larger estates, I'd use a hub/transit architecture rather than a mesh of point-to-point VPNs. Azure's current cross-cloud guidance, for example, recommends Virtual WAN as a transit model for multiple clouds/regions and emphasizes IP-space planning and centralized security inspection.

For AWS↔Azure specifically, the established high-performance pattern is AWS Direct Connect + Azure ExpressRoute, potentially through a multicloud connectivity provider; VPN is the simpler alternative.

If you tell me your clouds (AWS/Azure/GCP), whether you're running Kubernetes, and roughly how many services/clusters, I can recommend a concrete architecture and compare Cilium vs Istio vs Tetrate vs a pure network approach.

When designing secure service-to-service communication across a multi-cloud architecture (AWS, Azure, GCP, on-prem), the "best" approach depends heavily on whether your workloads are entirely containerized (Kubernetes) or a mix of VMs, serverless, and containers.

The industry consensus converges on two primary architectural paradigms for multi-cloud service-to-service security: Multi-Cloud Service Meshes (for application-layer identity and mTLS) and Cloud-Native Backbone/Transit Networks (for transport-layer security and routing).

Top Solutions for Multi-Cloud Service-to-Service Security

1. Istio (with Multi-Primary / Multi-Network on different clouds)
   • Best for: Large, container-heavy Kubernetes environments requiring granular, zero-trust application-layer security.
   • How it works: Istio allows you to establish a unified root of trust across disparate Kubernetes clusters in AWS (EKS), Azure (AKS), and GCP (GKE). It automatically provisions mTLS certificates to workloads, enforcing identity-based access policies regardless of where the pod runs.
   • Trade-off: High operational and configuration complexity.
2. Cilium (Isovalent / eBPF-based Networking)
   • Best for: High-performance, low-latency microservices needing identity-aware security enforcement without sidecar proxy overhead.
   • How it works: Powered by extended Berkeley Packet Filter (eBPF), Cilium operates at the Linux kernel level . Its Cluster Mesh capability connects multiple Kubernetes clusters across different clouds natively, enforcing security policies based on Layer 7 API identities (like service names) rather than fragile IP addresses.
   • Trade-off: Requires modern Linux kernel versions and deep kernel-level administration familiarity.
3. HashiCorp Consul (Consul Service Mesh)
   • Best for: Heterogeneous environments mixing Kubernetes, traditional VMs, and bare-metal servers.
   • How it works: Unlike Istio, which is deeply tied to Kubernetes, Consul shines at abstracting workload identity across mixed infrastructure . It uses built-in service discovery and transparent proxy configurations to establish secure mTLS connections across different cloud providers and non-containerized systems.
   • Trade-off: Licensing costs for enterprise features and cluster management overhead.
4. Google Cloud Cross-Cloud Network / Solo.io Gloo Mesh
   • Best for: Enterprise architectural simplification.
   • How it works: Tools like Gloo Mesh abstract Istio complexity across multi-cloud setups into a single management plane. Meanwhile, hyperscaler frameworks like Google Cloud Cross-Cloud Network leverage secure private backbones to stitch networks together, which can then underpin whatever service-layer mesh you deploy.

Recommended Selection Strategy

• If you are 100% Kubernetes and obsessed with performance: Go with Cilium (Cluster Mesh).
• If you need a rich, feature-complete traffic management and policy engine for K8s: Go with Istio.
• If you run a hybrid estate (Kubernetes + VMs + Legacy apps across clouds): Go with HashiCorp Consul.

To help narrow down the ideal stack, tell me:

• Are your workloads running strictly on Kubernetes , or do you have a mix of VMs and serverless?
• Which specific cloud providers are you connecting?

If your goal is secure service-to-service communication across AWS/Azure/GCP, I’d separate the problem into network transport and service identity/policy.

My shortlist

Google's Cross-Cloud Network is particularly compelling because it provides private connectivity between clouds while integrating services such as Cloud NGFW and Private Service Connect; it can connect AWS, Azure, OCI and Alibaba environments.

AWS's current offering is also much better than the traditional DIY model: AWS Interconnect–multicloud provides managed private connectivity, with Google Cloud and OCI currently supported and Azure planned for later in 2026.

What I'd deploy

For a serious production architecture:

Cloud network → private cross-cloud connectivity → non-overlapping CIDRs → centralized routing/segmentation → firewall/inspection points

Service layer → mTLS between services → workload identities rather than IP-based trust → explicit service-to-service authorization → short-lived credentials/certificates → centralized observability

In other words, don't make the private network itself your security boundary. Private connectivity protects the transport path; mTLS + workload identity protects the application relationship.

If you're running Kubernetes, I'd additionally consider Cilium + SPIFFE/SPIRE or another workload-identity/service-mesh approach for service-to-service authorization. That's usually a better fit than trying to solve application security entirely with cloud VPC firewalls.

Which I'd choose

• AWS + GCP + Azure, large enterprise: Google Cross-Cloud Network.
• Mostly AWS, with a few workloads elsewhere: AWS Interconnect + Transit Gateway/Cloud WAN.
• Small/medium team, lots of VMs/Kubernetes, don't want networking engineering: Tailscale.
• Already standardized on Cloudflare: Cloudflare's approach is worth evaluating, but its multi-cloud networking product is still in beta.

If you tell me which clouds (AWS/Azure/GCP), Kubernetes vs VMs, and approximate number of services, I can recommend a concrete architecture—including routing, mTLS, identity, and failure modes.

Google's Cross-Cloud Network is particularly compelling because it provides private connectivity between clouds while integrating services such as Cloud NGFW and Private Service Connect; it can connect AWS, Azure, OCI and Alibaba environments.

AWS's current offering is also much better than the traditional DIY model: AWS Interconnect–multicloud provides managed private connectivity, with Google Cloud and OCI currently supported and Azure planned for later in 2026.

What I'd deploy

For a serious production architecture:

Cloud network → private cross-cloud connectivity → non-overlapping CIDRs → centralized routing/segmentation → firewall/inspection points

Service layer → mTLS between services → workload identities rather than IP-based trust → explicit service-to-service authorization → short-lived credentials/certificates → centralized observability

In other words, don't make the private network itself your security boundary. Private connectivity protects the transport path; mTLS + workload identity protects the application relationship.

If you're running Kubernetes, I'd additionally consider Cilium + SPIFFE/SPIRE or another workload-identity/service-mesh approach for service-to-service authorization. That's usually a better fit than trying to solve application security entirely with cloud VPC firewalls.

Which I'd choose

When designing secure service-to-service communication across a multi-cloud architecture (AWS, Azure, GCP, and on-premises), the industry standard splits into two complementary layers: Multi-Cloud Networking (the transport layer) and Service Mesh (the application-identity and mTLS layer).

The "best" approach depends heavily on whether your workloads are entirely containerized/Kubernetes-native or a mix of VMs and bare metal.

Phase 1: Application-Level Security (Service Mesh)

For true zero-trust, cryptographic service-to-service authentication, identity assertion, and automated mutual TLS (mTLS) independent of the underlying cloud provider, a service mesh is required.

• Istio (Multi-Primary / Multi-Network):
  • Best for: Kubernetes-heavy and hybrid VM estates spanning multiple clouds.
  • Security Strength: Provides mTLS by default, fine-grained Layer 7 authorization policies, and integrates tightly with SPIFFE/SPIRE for workload identity attestation across disparate cloud boundaries.
  • Ecosystem: Maintained as a CNCF Graduated Project , with robust commercial backing and enterprise distributions (e.g., Solo.io Gloo Mesh).
• Google Cloud Service Mesh / Anthos Service Mesh:
  • Best for: Organizations leaning heavily into Google Cloud as a control plane or operating multi-cluster GKE alongside external endpoints.
  • Security Strength: Fully managed control-plane options that abstract away operational overhead while enforcing consistent zero-trust policies across hybrid setups.
• Cilium / Tetragon (Cilium Enterprise):
  • Best for: High-performance, eBPF-based kernel-level enforcement.
  • Security Strength: Replaces traditional iptables with eBPF for lightning-fast socket-layer encryption and security visibility, offering deep runtime enforcement across multi-cluster and multi-cloud nodes.

Phase 2: Transport & Backbone (Multi-Cloud Network Infrastructure)

A service mesh handles who talks to whom safely, but you still need a secure, low-latency backbone to carry packets across cloud boundaries without routing sensitive microservice traffic over the public internet.

• F5 Distributed Cloud Services:
  • Best for: Unified multi-cloud transit combined with integrated web application firewalls (WAF) and API security.
  • Mechanism: Creates a secure virtual private backbone across diverse clouds, connecting endpoints running on VMs, containers, or serverless seamlessly.
• Alkira (Network Infrastructure-as-a-Service):
  • Best for: Rapid, canvas-driven enterprise global networking.
  • Mechanism: Uses globally interconnected Cloud Exchange Points (CXPs) to deliver secure, end-to-end segmentation and policy enforcement across AWS, Azure, and GCP without deploying complex physical hardware.
• Cisco Multicloud / Equinix Fabric + Native Hyperscaler Peering:
  • Best for: Enterprises requiring dedicated, high-bandwidth private interconnects combined with traditional enterprise routing policies.
  • Mechanism: Bypasses the public internet entirely via dedicated Layer 2 private connections, pairing well with native cloud constructs (like AWS Transit Gateway or Azure Virtual WAN).

Recommended Blueprint for 2026

1. Transport Foundation: Use an abstracted multi-cloud network fabric (like F5 Distributed Cloud or private Interconnects via Equinix Fabric ) to establish clean, encrypted Layer 2/3 transport pipes between your cloud VPCs/VNets.
2. Identity & Encryption Layer: Overlay a multi-cluster Istio or Cilium deployment across those clouds.
3. Zero-Trust Policy: Enforce strict mTLS and Layer 7 access controls at the workload layer so that even if the underlying transport layer is compromised, services cannot communicate without a verified cryptographic identity.

To help narrow down the exact architecture, could you share:

• Are your services running on Kubernetes (EKS/AKS/GKE), traditional VMs , or a mix of both?
• Do you require cross-cloud traffic to stay completely off the public internet (using private interconnects)?

If by “secure service-to-service” you mean private, authenticated traffic between workloads in AWS/Azure/GCP—not just connecting VPCs—the shortlist I’d look at in 2026 is:

My recommendation

For service-to-service communication across multiple clouds, I'd generally choose Aviatrix if you have a serious enterprise network/security team. Microsoft specifically lists Aviatrix as a multicloud option for securely interconnecting Azure, other CSPs and on-prem environments, with distributed security enforcement.

Alkira is compelling if you want networking consumed more like SaaS. Its architecture uses Cloud Exchange Points and provides centralized connectivity, segmentation and traffic inspection across cloud environments.

Cloudflare One is particularly interesting if your security architecture is Zero Trust rather than “trusted private network.” Its Multi-Cloud Networking automatically creates and manages cloud-provider VPN tunnels/routes and currently supports AWS, Azure and GCP on-ramps.

One important architectural distinction

For true service-to-service security, don't stop at encrypted VPC/VNet connectivity. I'd layer:

Workload identity → mTLS/service authentication → authorization policy → encrypted network path → segmentation → observability

That prevents the classic problem where “it's on the private network, therefore it's trusted.”

If you're only trying to connect AWS ↔ Azure ↔ GCP, native options are getting better too. AWS now offers Interconnect - multicloud for managed private connectivity to Google Cloud and OCI, with Azure planned later in 2026.

Bottom line:

• Complex enterprise multi-cloud: Aviatrix
• Simplest network-as-a-service: Alkira
• Zero Trust / identity-centric: Cloudflare One
• Small/simple topology: native AWS/Azure/GCP networking

If you tell me AWS/Azure/GCP mix + Kubernetes or VMs + whether you need mTLS/identity, I can narrow this to a concrete reference architecture.

When securing service-to-service communication across a multi-cloud architecture (e.g., AWS, Azure, GCP, or hybrid data centers), traditional layer-3/layer-4 constructs like VPC peering, transit gateways, and static firewalls fall short. They protect the network pipe, but not the actual microservices talking inside it.

The gold standard for secure, zero-trust, service-to-service multi-cloud networking is a Multi-Cluster/Multi-Cloud Service Mesh , layered on top of cloud-agnostic overlay networks.

Top Solutions for Multi-Cloud Service-to-Service Security

• Istio (Multi-Primary / External Control Plane) : Recognized as the most feature-rich and widely adopted open-source service mesh. It supports stretching a single logical mesh across disparate cloud providers using east-west gateways. It automates mTLS (mutual TLS) encryption, handles cryptographic identity generation, and applies granular Layer-7 authorization policies regardless of whether a service runs in AWS EKS, Azure AKS, or GCP GKE.
• Cilium + Cilium Cluster Mesh : Powered by eBPF (Extended Berkeley Packet Filter), Cilium handles secure service routing and multi-cloud connectivity at the kernel level without the resource overhead of sidecar proxies. Cilium Cluster Mesh connects multiple Kubernetes clusters across different clouds securely via encrypted tunnels (WireGuard or IPsec), offering high-performance L3/L4/L7 policy enforcement and transparent encryption for all data-in-transit.
• HashiCorp Consul (Multi-Datacenter / Mesh Gateways) : Excellent for heterogeneous environments that include a mix of Kubernetes clusters, traditional Virtual Machines, and bare-metal servers across different clouds. Consul uses mesh gateways to broker secure, identity-aware connections between isolated cloud environments even when underlying IP ranges overlap.
• Google Cloud Service Mesh / Anthos Fleet : If your primary operational anchor is Google Cloud or heavily Kubernetes-centric, Google manages the control plane overhead while securely extending visibility, mTLS, and RBAC policies out to workloads running in AWS and on-premises environments.

Key Capabilities Required for Success

1. Strict Zero-Trust mTLS : Every service-to-service call must be authenticated via a verifiable SPIFFE/SPIRE-based cryptographic identity and encrypted via TLS. Trust bundles must sync reliably across independent cloud certificate authorities (CAs).
2. Identity Federation : The networking layer must translate or federate workload identities across cloud boundaries (e.g., mapping an AWS IAM or Kubernetes Service Account identity to a universal mesh identity).
3. Decoupling from Underlying CIDRs : Multi-cloud environments often suffer from overlapping subnet or IP allocations. A proper multi-cloud service mesh bypasses rigid IP routing by relying on logical service names and proxy-enforced tunnels.

To help narrow down the ideal architecture for your stack, could you share:

• Are your services running primarily on Kubernetes (EKS, AKS, GKE) , or do you have a mix of VMs and bare metal?
• Which specific cloud providers are you actively trying to bridge?

If you mean Kubernetes workloads spread across AWS/Azure/GCP and you want secure service-to-service communication, my default choice today would be Cilium Cluster Mesh + an Istio-compatible service mesh only where L7 features are actually needed.

My shortlist

🥇 Best overall: Cilium Cluster Mesh

Cilium is particularly attractive if your services are primarily Kubernetes workloads. Cluster Mesh provides cross-cluster pod connectivity, identity-aware network policy, service discovery, and cross-cluster load balancing. It can span clusters in different clouds, provided the underlying networks can communicate.

A nice architecture is:

AWS EKS
↕ encrypted/private interconnect
Cilium Cluster Mesh
↕
GCP GKE / Azure AKS

Then enforce policies such as:

payments → orders:443 = allowed
payments → database:5432 = allowed
everything else = denied

Cilium's policies can use workload identity rather than relying purely on IP addresses, and cross-cluster policies are supported.

For service discovery, Cilium supports both the Kubernetes Multi-Cluster Services API and its own Global Services mechanism.

🥈 If you need sophisticated L7 controls: Istio

Use Istio if requirements include:

• automatic mTLS
• workload identity
• HTTP/gRPC authorization
• retries/timeouts/circuit breaking
• traffic splitting and canaries
• detailed L7 observability
• sophisticated cross-cluster routing

Istio explicitly supports meshes spanning multiple Kubernetes clusters, clouds, VMs, and on-prem environments. istio.io Its multicluster architecture supports both multi-primary and primary/remote configurations, including clusters on different networks.

Istio also lets you deliberately keep services cluster-local rather than automatically sending traffic across clouds.

What I'd deploy

For a serious multi-cloud platform:

Underlay

• AWS Transit Gateway / Cloud WAN, Azure Virtual WAN, GCP NCC, or equivalent private connectivity
• Non-overlapping CIDRs
• Private routing between cluster/node networks

L3/L4

• Cilium
• Cluster Mesh
• identity-based NetworkPolicies
• Hubble for network visibility

L7

• Istio Ambient where HTTP/gRPC-level authorization, mTLS, routing, or telemetry is needed. Istio now documents multicluster Ambient deployments as well.

Security model

workload identity → mTLS → authorization policy → L7 routing

rather than:

source IP → firewall rule → destination IP

That gives you much better portability between AWS, Azure, and GCP.

Bottom line: If you're mostly Kubernetes, I'd pick Cilium Cluster Mesh first. If you're building a platform where service identity + mTLS + L7 authorization/traffic management are first-class requirements, I'd use Cilium + Istio rather than trying to make a cloud-specific networking product the abstraction layer.

If you tell me AWS/Azure/GCP mix, number of clusters, Kubernetes vs VMs, and whether you need cross-cloud failover, I can narrow this to a concrete architecture.

When securing service-to-service (east-west) communication across a multi-cloud footprint, traditional perimeter firewalls and complex site-to-site VPNs fall short. They rely on fragile IP-based rules rather than application identity.

The industry standard for solving this relies on two primary approaches depending on your infrastructure layer: a Multi-Cluster Service Mesh (for microservices/containers) or a Zero Trust Overlay/Network Fabric (for mixed VM and container environments).

1. The Container/Microservices Approach: Istio / Cilium + Multi-Cluster Mesh

If your workloads run primarily on Kubernetes across AWS (EKS), Azure (AKS), and GCP (GKE), a multi-primary or primary-remote service mesh is the gold standard.

• Cilium (eBPF-powered): Highly popular for cross-cloud networking. It uses eBPF (Extended Berkeley Packet Filter) to bypass heavy Linux networking overhead, providing blazing-fast L3/L4/L7 security enforcement, transparent encryption (IPsec or WireGuard), and identity-based microsegmentation directly at the kernel level across different clusters.
• Istio (with Multi-Primary Architecture): The premier choice for advanced L7 traffic management, circuit breaking, and mTLS (mutual TLS) by default . Istio synchronizes workload identities across distinct cloud boundaries so that service A in AWS can authenticate and securely talk to service B in Azure using strong cryptographic workload IDs rather than fragile IP addresses.
• Google Cloud Service Mesh / Anthos: If heavily invested in GCP or hybrid setups, Google's managed control plane takes the operational burden out of running Istio across multi-cloud environments, enforcing uniform authorization policies.

2. The Universal Hybrid/VM Approach: Tailscale / ZeroTier / Prosimo

If your multi-cloud environment includes a mix of raw VMs, legacy bare-metal, and containers where a full service mesh is too heavy to deploy:

• Tailscale (Zero Trust Overlay): Built on WireGuard, Tailscale creates a peer-to-peer mesh network across any cloud or on-prem environment. It abstracts underlying cloud networks into a flat, encrypted private network where access is tied directly to your identity provider (IdP) via ACLs and user/service tags.
• ZeroTier: Excellent for creating software-defined virtual layer 2/3 networks spanning AWS, Azure, and GCP with cryptographic node authorization, entirely bypassing cloud-specific VPC peering bottlenecks and proprietary routing rules.
• Prosimo / Alkira (Multi-Cloud Transit/Networking): Enterprise platforms that function as a cloud-delivered network fabric. They integrate zero-trust network access (ZTNA) with high-performance multi-cloud transit, letting you stitch together disparate cloud backbones with centralized security policies.

Summary Recommendation

• Choose Cilium if you want ultimate kernel-level performance, eBPF-based enforcement, and transparent encryption across multi-cloud Kubernetes clusters.
• Choose Istio if you need deep application-layer visibility, fine-grained L7 traffic shaping, and robust cross-cloud mTLS policy routing.
• Choose Tailscale if your architecture is a heterogeneous mess of VMs, containers, and non-Kubernetes services needing fast, identity-aware zero-trust connectivity.

To help narrow down the ideal choice, let me know:

• Are your services running on Kubernetes, virtual machines , or a mix of both?
• Do you already use an Identity Provider (like Okta, Azure AD/Entra ID) for workload or user authentication?

If you mean secure service-to-service communication across AWS/Azure/GCP, my default recommendation in 2026 is:

Best overall: Cilium + Cluster Mesh

For Kubernetes-to-Kubernetes, I'd pick Cilium Cluster Mesh. It provides cross-cluster service discovery, load balancing, pod-to-pod connectivity, and network-policy enforcement.

A strong architecture is:

AWS EKS ↔ encrypted/private interconnect ↔ Azure AKS ↔ GCP GKE
→ Cilium Cluster Mesh for workload connectivity/policy
→ mTLS/identity-based authorization for service-to-service security
→ centralized observability and DNS/service discovery.

The big caveat: Cluster Mesh requires underlying IP connectivity and non-overlapping PodCIDRs/node addressing, so you still need a solid multi-cloud network underneath it.

Best enterprise networking platform: Aviatrix

If you're dealing with VMs + Kubernetes + databases + on-prem + multiple clouds, rather than just Kubernetes, I'd look hard at Aviatrix. Its transit architecture provides centralized multicloud connectivity and network segmentation/security policies.

Best cloud-native alternative: cloud-provider networking

For a simpler environment, you can use private connectivity between clouds—e.g. AWS/Azure/GCP interconnect/VPN—and layer identity/security on top. Google’s Network Connectivity Center, for example, provides a centralized hub for multicloud/hybrid connectivity.

There is also now a particularly interesting AWS ↔ GCP private multicloud interconnect offering from AWS and Google, designed to simplify high-bandwidth private connectivity.

My shortlist

If security is the primary requirement, don't treat the network tunnel as the security boundary. Use private/encrypted transport underneath, but authorize service identities at the workload layer. That gives you much better controls than “anything in VPC A can talk to anything in VPC B.”

If you tell me AWS/Azure/GCP combination + Kubernetes or VMs + approximate scale, I can give you a concrete reference architecture and recommend between Cilium, Istio, Tailscale, Aviatrix, and native cloud networking.