AWS Transit Gateway

What it is

AWS Transit Gateway is a network transit hub that interconnects VPCs and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry networks. Instead of a mesh of VPC peering connections, each network attaches once to the transit gateway, which acts as a Regional virtual router at layer 3 and scales with traffic.

Choose Transit Gateway when a question involves many VPCs (dozens or hundreds), transitive routing between VPCs and on premises, centralized inspection or egress, or connecting networks across accounts and AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry in a hub-and-spoke design.

Concepts

Attachments:
- VPCs: specify one SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry per AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry for the transit gateway to use.
- Site-to-Site VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry connections.
- Direct Connect gateways.
- Peering with other transit gateways, in the same or another Region, and the same or another account.
- Connect attachments for SD-WAN appliances.
- Client VPN endpoints and network function attachments.
Route tables:
- Each attachment is associated with one transit gateway route table, which decides where its traffic goes.
- Attachments can propagate their routes into route tables automatically, and you can add static routes.
- Peering attachments use static routes only.
- Several route tables let you segment the network, for example isolating development VPCs from production while both reach shared services.
Sharing: share a transit gateway with other accounts using AWS RAM, so they can attach their VPCs.
ECMP: for VPN attachments, enable Equal Cost Multipath routing to spread traffic across several VPN tunnels and get more bandwidth.
Appliance mode: for a VPC with StatefulKeeping track of earlier requests or connections. A stateful firewall, such as a security group, remembers allowed connections and lets their return traffic back in automatically.Glossary entry network appliances, such as firewalls, keep both directions of a flow in the same Availability Zone.
Bandwidth: up to 100 Gbps in each direction per VPC attachment per Availability Zone.
Multicast is supported between attached VPCs.

A transit gateway as a hub. A production VPC, a development VPC, and a shared services VPC each connect to the transit gateway with one attachment, and so do a Site-to-Site VPN and a Direct Connect gateway. Traffic between any of them goes through the transit gateway and its route tables instead of a separate connection between every pair.

Security, resilience, performance, and cost

Security

Use route tables to segment traffic, and route traffic through an inspection VPC (for example with AWS Network Firewall or a Gateway Load Balancer) for centralized security.
Traffic between AWS data centers, including inter-Region peering, is encrypted at the physical layer.

Resilience

Attach subnets in multiple Availability Zones. For on-premises connectivity, use redundant VPN tunnels or Direct Connect connections.

Cost

Pay per attachment per hour and per GB of data processed. For a few VPCs with simple needs, VPC peering can be cheaper, because peering has no hourly charge.

Transit Gateway or another option?

If the requirement is	Choose
Connect many VPCs and on-premises networks with transitive routing	AWS Transit Gateway
Connect a few VPCs directly, cheaply	VPC peering
Expose one service to other VPCs without full network access	AWS PrivateLink
Connect Regions together through your hub	Transit gateway inter-Region peering
Combine many Site-to-Site VPN tunnels for bandwidth	Transit Gateway with VPN ECMP

Reverse mindmap: when the question points here

Is it AWS Transit Gateway?

Yes, when the question says
- Connect hundreds of VPCs and on premises leads to Transit Gateway
- Avoid a full mesh of peering connections leads to Transit Gateway hub
- Transitive routing between VPCs leads to Transit Gateway
- VPCs in many accounts share one network hub leads to Transit Gateway shared with RAM
Configure it
- Keep dev and prod isolated leads to Separate route tables
- Learn routes automatically leads to Route propagation
- Connect two Regions leads to Transit gateway peering, static routes
- More VPN bandwidth leads to ECMP across VPN tunnels
- Firewall appliances in a VPC leads to Appliance mode
No, when the question says
- Two VPCs, lowest cost leads to VPC peering
- One service to consumers, no network access leads to PrivateLink

Key takeaways

Transit Gateway is a Regional hub that connects VPCs, VPNs, Direct Connect gateways, and other transit gateways, with transitive routing.
Route table association and propagation control and segment traffic; peering attachments use static routes.
Share it across accounts with AWS RAM; peer it across Regions.
ECMP across VPN tunnels adds bandwidth; appliance mode keeps stateful flows symmetric.
Pay per attachment-hour and per GB; VPC peering can be cheaper for a few VPCs.