Abstract: Techniques for resource-based network traffic management are described. A service of a cloud provider network receives a traffic policy, the traffic policy identifying a path to a gateway to an external network, the path identifies at least one network function in the path by a resource identifier of the cloud provider network. Traffic policy association data is received, the traffic policy association data associating the traffic policy with one or more virtual networks hosted by the cloud provider network. A network configuration of the cloud provider network is updated to route network traffic from a first virtual network to the gateway to the external network through the network function.

Abstract: Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network, where the ingress traffic is destined for a block of public or private IP addresses. The route instructs the edge routing device to forward such ingress traffic to a network interface of a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of one or more public or private IP addresses in the block of public/private IP addresses. The edge routing device may identify the route in the route table that forwards the ingress network traffic destined for the block of public or private IP addresses to the network interface for the network appliance.