NetworkTools
Sign In
1VPC Design2Security Groups & NACLs3Virtual Routers4Hybrid Connectivity5Cloud Load Balancing6Cloud DNS & CDN7Container Networking
← Back to Cloud Networking

Learning Objectives

  • Understand Transit Gateway architecture and use cases
  • Compare VPC peering vs Transit Gateway
  • Design multi-VPC connectivity without routing loops

VPC Peering

VPC peering connects two VPCs using private IP addresses. Traffic stays within the cloud provider's network — no internet gateway, no VPN. Peering is a one-to-one connection — it does not support transitive routing. If VPC A is peered with VPC B and VPC B is peered with VPC C, VPC A cannot reach VPC C through VPC B.

Transit Gateway

A Transit Gateway (TGW) acts as a central hub for connecting multiple VPCs, VPNs, and Direct Connect connections. It supports transitive routing, making it the preferred choice for any network with more than a few VPCs. Each VPC attaches to the TGW, and route tables within the TGW control how traffic flows between attachments.

Transit Gateway Hub-and-Spoke Architecture

AttachmentAttachmentAttachmentAttachmentVPN / DXTransit GatewayProduction VPC 10.0.0.0/16Staging VPC 10.1.0.0/16Shared Services 10.2.0.0/16Dev VPC 10.3.0.0/16Corporate DC 192.168.0.0/16

Route Tables and Segmentation

A TGW uses route tables to control traffic between attachments. You can create isolated segments — for example, dev VPCs can talk to each other but not to production. This is done by associating each attachment with a specific route table and propagating routes selectively.

You have 12 VPCs: 3 production, 3 staging, 3 development, and 3 shared services. Production and shared services must reach each other. Staging must reach shared services but not production. Dev VPCs must be isolated from everything. How many Transit Gateway route tables do you need?

VPC Connectivity Design

VPC Peering vs Transit Gateway

| Feature | VPC Peering | Transit Gateway | |---------|-------------|-----------------| | Transitive routing | No | Yes | | Max connections | 125 per VPC | Thousands | | Cross-account | Yes | Yes | | Cross-region | Yes | Yes | | Cost per connection | No hourly fee | Per-attachment hourly | | Bandwidth | Up to 25 Gbps | Up to 50 Gbps (per attachment) |

Routing Considerations

Avoid route propagation loops by carefully controlling which routes are advertised to each attachment. A common pattern is to create separate route tables for production, staging, and shared services. Each route table contains only the routes necessary for its group.

Why can't VPC peering be used to create a hub-and-spoke topology?

What mechanism does a Transit Gateway use to isolate traffic between groups of VPCs?

Key Takeaways

  • VPC peering is simple but does not support transitive routing
  • Transit Gateway is the hub for multi-VPC and hybrid connectivity
  • TGW route tables enforce segmentation between environments
  • Peering is cost-effective for small numbers of VPCs; TGW scales better
  • Always plan route propagation to avoid leaks between environments
PreviousSecurity Groups & NACLsNextHybrid Connectivity