AWS Transit Gateway (TGW)

Tharunsl — Tue, 15 Sep 2026 23:30:39 +0000

Central Hub for AWS Networking

Connect VPCs, VPNs, Direct Connect, and multiple AWS accounts through one managed router.

Regional service

•

Layer 3 routing
What is AWS Transit Gateway?

AWS Transit Gateway (TGW) is a fully managed network transit hub that connects multiple Amazon VPCs and on-premises networks through a single gateway. Instead of creating many VPC peering connections, every network connects once to the Transit Gateway, which greatly simplifies routing and management.

Why was Transit Gateway created?

Without TGW, connecting 10 VPCs requires many peering connections.

Key idea:

VPC Peering: Complex mesh (many connections)

Transit Gateway: One central hub (hub-and-spoke architecture)

This reduces operational complexity and scales to thousands of networks.

Real-world architecture

Imagine a company with three departments and an on-premises data center.

Every VPC communicates through the Transit Gateway rather than directly with each other.

Core components

Transit Gateway

The central virtual router that forwards traffic between attached networks.

Attachments

An attachment is a connection between TGW and another resource.

Supported attachments include VPCs, Site-to-Site VPN, Direct Connect Gateway, TGW Peering, and SD-WAN Connect attachments.
Amazon VPC

Route Tables

Route tables decide where packets should go based on destination CIDR blocks.

Route Propagation

Routes from VPCs or VPNs can automatically appear in TGW route tables using dynamic propagation.
Amazon VPC

Supported attachments

Attachment Type

Purpose

VPC

Connect Amazon VPCs

Site-to-Site VPN

Connect on-premises via VPN

Direct Connect Gateway

Private dedicated connectivity

Transit Gateway Peering

Connect TGWs across Regions

Connect Attachment

SD-WAN integration using GRE/BGP

How routing works:
Routing happens in two stages.

Stage 1 – VPC Route Table

Inside VPC A:

Destination

Target

10.1.0.0/16

Local

10.2.0.0/16

Transit Gateway

Stage 2 – TGW Route Table

Inside Transit Gateway:

Destination

Target

10.1.0.0/16

VPC A Attachment

10.2.0.0/16

VPC B Attachment

The packet first reaches TGW, then TGW forwards it to the correct attachment.

Route association vs propagation

This is one of the most important interview questions.

Association

One attachment belongs to one TGW route table.

Think of it as which routing policy this VPC follows.

Propagation

A VPC advertises its CIDR into one or more TGW route tables automatically.

Think of it as sharing reachable networks.

Creating a Transit Gateway (Console)

Step-by-step

Open VPC Console

Select Transit Gateways

Click Create Transit Gateway

Enter a name

Keep default ASN (or customize)

Create the TGW

Create VPC Attachments

Update VPC route tables

Verify connectivity

AWS automatically creates a default TGW route table unless you disable it.

Multi-account architecture

Large organizations usually separate workloads into different AWS accounts.

The Networking Account owns the Transit Gateway, while other accounts attach their VPCs using AWS Resource Access Manager (RAM). This centralizes governance and routing.

Hybrid connectivity

Transit Gateway also connects your office to AWS.

Supported options:

Site-to-Site VPN

AWS Direct Connect

BGP dynamic routing

Equal Cost Multipath (ECMP) for VPNs

This allows branches and data centers to securely access AWS resources

Transit Gateway Peering

Need connectivity between regions?

Benefits:

Inter-region communication

Disaster recovery

Global application architecture

Traffic stays on AWS global network

Security

Transit Gateway itself is not a firewall. It only routes traffic.

Service

Role

Security Groups

Instance-level filtering

NACL

Subnet-level filtering

AWS Network Firewall

Deep packet inspection

IAM

Control TGW administration

A common design places AWS Network Firewall in an Inspection VPC, and TGW routes traffic through it before reaching destination VPCs.

Monitoring

AWS provides built-in monitoring through:

Amazon CloudWatch – bandwidth, packets, drops

VPC Flow Logs – analyze routed traffic

Transit Gateway Network Manager – global network visibility

CloudTrail – audit configuration changes

Transit Gateway vs VPC Peering

Feature

VPC Peering

Transit Gateway

Architecture

Mesh

Hub-and-Spoke

Scalability

Low

Very High

Cross-account

Yes

Hybrid Connectivity

Yes

Central Routing

Yes

Route Tables

VPC only

Dedicated TGW tables

For 2–3 VPCs, peering may be enough. For enterprise environments with many VPCs, TGW is the preferred design.

Pricing model

Transit Gateway pricing has two main components:

Hourly charge per attachment

Data processing charge (per GB of traffic processed)

The account that owns the source attachment is typically charged, with options for flexible cost allocation.

Key Takeaways

Purpose: Centralized routing for AWS and hybrid networks.

Architecture: Hub-and-spoke instead of complex VPC peering.

Main Components: TGW, Attachments, Route Tables, Propagation.

Supports: VPC, VPN, Direct Connect, SD-WAN, Peering.

Best For: Enterprise, multi-account, and hybrid cloud networking.

Cloud Workshop

Tharunsl — Tue, 15 Sep 2026 06:49:12 +0000

AWS Cloud Workshop – Portfolio Website Deployment Using S3 and CloudFront

Introduction

As part of the AWS Cloud Workshop, I learned the basic concepts of cloud computing and explored different AWS services used for hosting and deploying websites. The main services covered during the workshop were Amazon S3 and Amazon CloudFront. As a practical activity, I created and published my personal portfolio website using these AWS services. This workshop helped me understand how websites can be hosted on the cloud without requiring a physical server.

Amazon S3

Amazon Simple Storage Service (S3) is a cloud-based object storage service provided by AWS. It can be used to store and retrieve different types of files such as HTML files, CSS files, JavaScript files, images, and other resources. During the workshop, I created an S3 bucket and used it to store the files of my portfolio website. The website files were uploaded into the bucket, and the required configuration was done to make the website accessible through the internet.

Portfolio Website Deployment

For the practical implementation, I created a personal portfolio website containing information such as my introduction, skills, projects, education, and contact details. The website was developed using basic web technologies such as HTML and CSS. After completing the website, all the required files, including the HTML, CSS, and image files, were uploaded to the Amazon S3 bucket. The S3 bucket was then configured for static website hosting, with the index.html file specified as the main page of the website. After completing the configuration, I tested the website to make sure that all the contents and styling were displayed correctly.

Amazon CloudFront

Amazon CloudFront is a Content Delivery Network (CDN) service provided by AWS. It is used to deliver website content to users with lower latency by distributing content through AWS edge locations. During the workshop, I created a CloudFront distribution and configured the S3 bucket as the origin. The portfolio website was connected to CloudFront, and the default root object was configured as index.html. After the distribution was successfully deployed, CloudFront provided a domain name through which the portfolio website could be accessed.

Testing and Verification

After completing the S3 and CloudFront configuration, I tested the portfolio website using the CloudFront URL in a web browser. The homepage was successfully displayed, and I verified that the different sections, images, styles, and other website resources were loading correctly. This confirmed that the portfolio website had been successfully deployed on AWS and was accessible through the internet.

Learning Outcomes

Through this workshop, I gained practical knowledge about cloud computing and AWS services. I learned how to create an S3 bucket, upload and manage website files, configure static website hosting, and deploy a portfolio website. I also learned about Amazon CloudFront and how a CDN can be used to efficiently deliver website content. The practical experience helped me understand the basic process of deploying and accessing a website using cloud infrastructure.

what we have learned

Conclusion

The AWS Cloud Workshop provided me with hands-on experience in deploying a static portfolio website using Amazon S3 and Amazon CloudFront. S3 was used to store the website files, while CloudFront was used to distribute the content efficiently. Successfully publishing my portfolio website helped me understand how cloud services can be used for website hosting and content delivery. Overall, the workshop gave me a better understanding of AWS and the practical applications of cloud computing.

DEV Community: Tharunsl