Central Hub for AWS Networking
Connect VPCs, VPNs, Direct Connect, and multiple AWS accounts through one managed router.
Regional service
•
Layer 3 routing
What is AWS Transit Gateway?
AWS Transit Gateway (TGW) is a fully managed network transit hub that connects multiple Amazon VPCs and on-premises networks through a single gateway. Instead of creating many VPC peering connections, every network connects once to the Transit Gateway, which greatly simplifies routing and management.
Why was Transit Gateway created?
Without TGW, connecting 10 VPCs requires many peering connections.
Key idea:
VPC Peering: Complex mesh (many connections)
Transit Gateway: One central hub (hub-and-spoke architecture)
This reduces operational complexity and scales to thousands of networks.
Real-world architecture
Imagine a company with three departments and an on-premises data center.
Every VPC communicates through the Transit Gateway rather than directly with each other.
Core components
- Transit Gateway
The central virtual router that forwards traffic between attached networks.
- Attachments
An attachment is a connection between TGW and another resource.
Supported attachments include VPCs, Site-to-Site VPN, Direct Connect Gateway, TGW Peering, and SD-WAN Connect attachments.
Amazon VPC
- Route Tables
Route tables decide where packets should go based on destination CIDR blocks.
- Route Propagation
Routes from VPCs or VPNs can automatically appear in TGW route tables using dynamic propagation.
Amazon VPC
Supported attachments
Attachment Type
Purpose
VPC
Connect Amazon VPCs
Site-to-Site VPN
Connect on-premises via VPN
Direct Connect Gateway
Private dedicated connectivity
Transit Gateway Peering
Connect TGWs across Regions
Connect Attachment
SD-WAN integration using GRE/BGP
How routing works:
Routing happens in two stages.
Stage 1 – VPC Route Table
Inside VPC A:
Destination
Target
10.1.0.0/16
Local
10.2.0.0/16
Transit Gateway
Stage 2 – TGW Route Table
Inside Transit Gateway:
Destination
Target
10.1.0.0/16
VPC A Attachment
10.2.0.0/16
VPC B Attachment
The packet first reaches TGW, then TGW forwards it to the correct attachment.
Route association vs propagation
This is one of the most important interview questions.
Association
One attachment belongs to one TGW route table.
Think of it as which routing policy this VPC follows.
Propagation
A VPC advertises its CIDR into one or more TGW route tables automatically.
Think of it as sharing reachable networks.
Creating a Transit Gateway (Console)
Step-by-step
Open VPC Console
Select Transit Gateways
Click Create Transit Gateway
Enter a name
Keep default ASN (or customize)
Create the TGW
Create VPC Attachments
Update VPC route tables
Verify connectivity
AWS automatically creates a default TGW route table unless you disable it.
Multi-account architecture
Large organizations usually separate workloads into different AWS accounts.
The Networking Account owns the Transit Gateway, while other accounts attach their VPCs using AWS Resource Access Manager (RAM). This centralizes governance and routing.
Hybrid connectivity
Transit Gateway also connects your office to AWS.
Supported options:
Site-to-Site VPN
AWS Direct Connect
BGP dynamic routing
Equal Cost Multipath (ECMP) for VPNs
This allows branches and data centers to securely access AWS resources
Transit Gateway Peering
Need connectivity between regions?
Benefits:
Inter-region communication
Disaster recovery
Global application architecture
Traffic stays on AWS global network
Security
Transit Gateway itself is not a firewall. It only routes traffic.
Service
Role
Security Groups
Instance-level filtering
NACL
Subnet-level filtering
AWS Network Firewall
Deep packet inspection
IAM
Control TGW administration
A common design places AWS Network Firewall in an Inspection VPC, and TGW routes traffic through it before reaching destination VPCs.
Monitoring
AWS provides built-in monitoring through:
Amazon CloudWatch – bandwidth, packets, drops
VPC Flow Logs – analyze routed traffic
Transit Gateway Network Manager – global network visibility
CloudTrail – audit configuration changes
Transit Gateway vs VPC Peering
Feature
VPC Peering
Transit Gateway
Architecture
Mesh
Hub-and-Spoke
Scalability
Low
Very High
Cross-account
Yes
Yes
Hybrid Connectivity
No
Yes
Central Routing
No
Yes
Route Tables
VPC only
Dedicated TGW tables
For 2–3 VPCs, peering may be enough. For enterprise environments with many VPCs, TGW is the preferred design.
Pricing model
Transit Gateway pricing has two main components:
Hourly charge per attachment
Data processing charge (per GB of traffic processed)
The account that owns the source attachment is typically charged, with options for flexible cost allocation.
Key Takeaways
Purpose: Centralized routing for AWS and hybrid networks.
Architecture: Hub-and-spoke instead of complex VPC peering.
Main Components: TGW, Attachments, Route Tables, Propagation.
Supports: VPC, VPN, Direct Connect, SD-WAN, Peering.
Best For: Enterprise, multi-account, and hybrid cloud networking.
