AWS Transit Gateway
AWS Transit Gateway is a network hub of Amazon Web Services used to interconnect multiple VPCs, letting an organization attach all its hybrid connectivity and control its entire AWS routing configuration in one place. It is the most effective approach for linking an on-premises network to numerous VPCs located in separate regions, often alongside AWS Direct Connect or AWS Site-to-Site VPN, and it solves the complexity that grows out of many-to-many VPC peering connections.
Key points
- Can have more than one Transit Gateway per region. Transit Gateways can be peered both within the same Region (intra-Region peering) and across Regions (inter-Region peering); intra-Region peering has been supported since December 2021, correcting older material that claimed same-region peering was unsupported.
- Supports attaching Amazon VPCs with IPv6 CIDRs.
- Solves the problem of complex VPC peering connections.
- Reduces the complexity of maintaining VPN connections with hundreds of VPCs, which is especially useful for large enterprises.
- Effective for hybrid cloud architectures connecting on-premises networks to AWS using AWS Direct Connect.
- Transit Gateway vs. VPC Peering:
- Transit Gateway supports transitive routing across attachments, so a VPC can reach another VPC or on-premises network through the hub; VPC peering has no transitive routing — traffic cannot hop through a peered VPC to reach a third VPC, which is why full-mesh peering grows in complexity as VPCs are added.
- Transit Gateway has an hourly charge per attachment in addition to data transfer fees; VPC Peering does not charge for data transfer.
- Multicast traffic can be routed between VPC attachments to a Transit Gateway; multicast traffic cannot be routed to peering connections.
- Transit Gateway provides bandwidth of up to 100 Gbps in each direction (100 Gbps ingress and 100 Gbps egress) per VPC attachment per Availability Zone (older material cites a 50 Gbps burst-bandwidth ceiling); VPC Peering provides no aggregate bandwidth limit.
- Security groups do not currently work with Transit Gateway; security groups work with intra-Region VPC peering.
Pricing
- Hourly charge per attachment plus data transfer fees (VPC Peering has no data transfer charge).