AWS Transit Gateway
Central hub connecting VPCs
A central hub-and-spoke router connecting thousands of VPCs, VPNs and Direct Connect within a Region; it has its own route tables for network segmentation, replacing a tangled mesh of peering connections.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA
Think of it asLike a central train station: every line comes in here and you transfer to another line.
When to use it
✓ Use it when
You have many VPCs/accounts that need to connect with each other and with on-prem.
✗ Avoid it when
Only 2–3 VPCs → VPC peering; exposing just one service → PrivateLink.
Common uses
- Connecting dozens of VPCs across many accounts
- Consolidating VPN/Direct Connect at one point
- Separating prod/dev networks with route tables
What does it cost?
- Pricing model: Charged hourly per attachment plus GB of data processed.
Data processing fees are added on top of normal data transfer fees.
When the question asks to connect many VPCs and on-premises with a simple hub-and-spoke network and transitive routing, choose Transit Gateway; for only 2-3 VPCs at lowest cost, VPC peering; to expose only one service, PrivateLink.
Frequently asked questions
How is Transit Gateway different from VPC peering?
VPC peering is one-to-one and not transitive: if A peers with B and B with C, A still cannot reach C through B, so many VPCs become a tangled mesh. Transit Gateway is a central hub; each VPC needs one attachment, and route tables control who can talk to whom. In return it charges per attachment and data processed, while peering is cheaper.
How do I share a Transit Gateway across accounts?
Use AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts or a whole AWS Organization; each account creates attachments for its own VPCs. To separate environments (for example prod and dev cannot see each other), use multiple route tables and associate each attachment with the right one.
What can Transit Gateway connect, and is it limited to one Region?
It connects VPCs, Site-to-Site VPN, Direct Connect (through a Direct Connect gateway) and other Transit Gateways. Each Transit Gateway lives in one Region; to span Regions, use inter-Region peering between Transit Gateways. It also supports multicast, which peering does not.
Related services
SAA-C03 study guide
Transit Gateway is covered in these study modules: