Skip to main content
In this lesson we explain AWS Transit Gateway — what it is, why it exists, how it works, and when to use it.

​
Problem: VPC peering doesn’t scale

By default, VPCs do not communicate with each other. VPC peering creates point‑to‑point routing between two VPCs so resources can communicate. However, VPC peering does not support transitive routing:
  • If VPC1 peers with VPC2, and VPC2 peers with VPC3, VPC1 can reach VPC2 and VPC3 can reach VPC2.
  • VPC1 cannot reach VPC3 through VPC2 because peering is non‑transitive.
  • For N VPCs, full connectivity via peering requires a full mesh of peering connections, which becomes difficult to manage as N grows.
This scaling problem also applies to on‑premises connectivity: without a hub, you’d need a separate VPN or Direct Connect for each VPC.
A VPC Peering diagram showing a corporate data center with a customer gateway on the left connected to multiple cloud VPCs and routers on the right. Purple cloud icons, circular router symbols and padlock icons illustrate a full-mesh of peering links and security between the VPCs and the on‑prem environment.

​
What is AWS Transit Gateway?

AWS Transit Gateway is a managed, scalable hub that centralizes routing between multiple VPCs and on‑premises networks. Instead of creating many VPC peering links, each VPC attaches to a single Transit Gateway, which performs routing between attachments. This hub‑and‑spoke design provides the effect of a full mesh with far less administrative overhead. Key benefits:
  • Centralized routing and reduced operational complexity
  • Transitive routing between attached VPCs and on‑premises links
  • Simplified on‑premises connectivity (terminate VPNs or Direct Connect on the Transit Gateway)
  • Support for Transit Gateway peering across Regions and Accounts

​
How Transit Gateway works

  • Create a single Transit Gateway resource.
  • Attach each VPC (and on‑premises connection) to the Transit Gateway instead of creating peering links.
  • The Transit Gateway routes traffic between attachments using Transit Gateway route tables.
  • You can terminate VPNs and Direct Connect connections on the Transit Gateway and route to any attached VPC.
Transit Gateway routing is controlled by Transit Gateway route tables. You must configure route table associations and propagations for attachments (VPCs, VPNs, Direct Connect, etc.) to enable traffic flow. Also note that while Transit Gateway peering extends connectivity across Regions and accounts, some edge-to-edge scenarios (for example, routing traffic from a VPN or Direct Connect attached to one Transit Gateway through a peering attachment to another Transit Gateway) have restrictions. Review the official AWS Transit Gateway documentation for routing, propagation, and peering limits.

​
Attachments and ENIs: one subnet per Availability Zone

When you attach a VPC to a Transit Gateway, you must specify one subnet in each Availability Zone (AZ) where you want Transit Gateway traffic to flow. For each specified subnet, Transit Gateway creates an Elastic Network Interface (ENI) in that subnet (one ENI per AZ).
  • If your VPC spans three AZs and you want the Transit Gateway to route traffic in all three AZs, provide one subnet from each AZ for the VPC attachment.
  • Any AZ where you want Transit Gateway connectivity must have a subnet selected for the attachment.
When attaching a VPC to a Transit Gateway, select one subnet per AZ in which you want the Transit Gateway to route traffic. The Transit Gateway creates ENIs in those subnets to enable connectivity and high availability.

​
Transit Gateway peering and multi‑region/multi‑account networks

Transit Gateways can peer with other Transit Gateways, enabling multi‑region or cross‑account network topologies without building complex VPC peering meshes. Peering extends routing between Transit Gateways but be aware of the routing limitations mentioned above (e.g., some edge‑to‑edge forwarding restrictions).
A slide titled "Transit Gateway Peerings" showing two regions, each containing an AWS Transit Gateway icon. The gateways are linked by a dashed purple bidirectional line indicating a peering connection.

​
When to use Transit Gateway vs VPC Peering

​
Summary

AWS Transit Gateway provides a scalable hub-and-spoke routing model for connecting VPCs and on‑premises networks. It eliminates the need for a full mesh of VPC peering connections by:
  • Centralizing routing through a single Transit Gateway resource
  • Supporting transitive routing between attached VPCs and on‑prem links
  • Requiring one subnet per AZ for each VPC attachment so ENIs can be created
  • Allowing Transit Gateway peering across Regions and Accounts to extend connectivity
A presentation slide with a turquoise gradient left panel labeled "Summary." On the right are four colorful numbered bullets listing Transit Gateway features (simplified VPC/on‑premises networking, transitive routing, a subnet-per‑AZ requirement, and peering across regions/accounts).

Watch Video