AWS Transit Gateway (TGW)

Central Hub for AWS Networking

Connect VPCs, VPNs, Direct Connect, and multiple AWS accounts through one managed router.

Regional service

•

Layer 3 routing
What is AWS Transit Gateway?

AWS Transit Gateway (TGW) is a fully managed network transit hub that connects multiple Amazon VPCs and on-premises networks through a single gateway. Instead of creating many VPC peering connections, every network connects once to the Transit Gateway, which greatly simplifies routing and management.

Why was Transit Gateway created?

Without TGW, connecting 10 VPCs requires many peering connections.

Key idea:

VPC Peering: Complex mesh (many connections)

Transit Gateway: One central hub (hub-and-spoke architecture)

This reduces operational complexity and scales to thousands of networks.

Real-world architecture

Imagine a company with three departments and an on-premises data center.

Every VPC communicates through the Transit Gateway rather than directly with each other.

Core components

1. Transit Gateway

The central virtual router that forwards traffic between attached networks.

1. Attachments

An attachment is a connection between TGW and another resource.

Supported attachments include VPCs, Site-to-Site VPN, Direct Connect Gateway, TGW Peering, and SD-WAN Connect attachments.
Amazon VPC

1. Route Tables

Route tables decide where packets should go based on destination CIDR blocks.

1. Route Propagation

Routes from VPCs or VPNs can automatically appear in TGW route tables using dynamic propagation.
Amazon VPC

Supported attachments

Attachment Type

Purpose

VPC

Connect Amazon VPCs

Site-to-Site VPN

Connect on-premises via VPN

Direct Connect Gateway

Private dedicated connectivity

Transit Gateway Peering

Connect TGWs across Regions

Connect Attachment

SD-WAN integration using GRE/BGP

How routing works:
Routing happens in two stages.

Stage 1 – VPC Route Table

Inside VPC A:

Destination

Target

10.1.0.0/16

Local

10.2.0.0/16

Transit Gateway

Stage 2 – TGW Route Table

Inside Transit Gateway:

Destination

Target

10.1.0.0/16

VPC A Attachment

10.2.0.0/16

VPC B Attachment

The packet first reaches TGW, then TGW forwards it to the correct attachment.

Route association vs propagation

This is one of the most important interview questions.

Association

One attachment belongs to one TGW route table.

Think of it as which routing policy this VPC follows.

Propagation

A VPC advertises its CIDR into one or more TGW route tables automatically.

Think of it as sharing reachable networks.

Creating a Transit Gateway (Console)

Step-by-step

Open VPC Console

Select Transit Gateways

Click Create Transit Gateway

Enter a name

Keep default ASN (or customize)

Create the TGW

Create VPC Attachments

Update VPC route tables

Verify connectivity

AWS automatically creates a default TGW route table unless you disable it.

Multi-account architecture

Large organizations usually separate workloads into different AWS accounts.

The Networking Account owns the Transit Gateway, while other accounts attach their VPCs using AWS Resource Access Manager (RAM). This centralizes governance and routing.

Hybrid connectivity

Transit Gateway also connects your office to AWS.

Supported options:

Site-to-Site VPN

AWS Direct Connect

BGP dynamic routing

Equal Cost Multipath (ECMP) for VPNs

This allows branches and data centers to securely access AWS resources

Transit Gateway Peering

Need connectivity between regions?

Benefits:

Inter-region communication

Disaster recovery

Global application architecture

Traffic stays on AWS global network

Security

Transit Gateway itself is not a firewall. It only routes traffic.

Service

Role

Security Groups

Instance-level filtering

NACL

Subnet-level filtering

AWS Network Firewall

Deep packet inspection

IAM

Control TGW administration

A common design places AWS Network Firewall in an Inspection VPC, and TGW routes traffic through it before reaching destination VPCs.

Monitoring

AWS provides built-in monitoring through:

Amazon CloudWatch – bandwidth, packets, drops

VPC Flow Logs – analyze routed traffic

Transit Gateway Network Manager – global network visibility

CloudTrail – audit configuration changes

Transit Gateway vs VPC Peering

Feature

VPC Peering

Transit Gateway

Architecture

Mesh

Hub-and-Spoke

Scalability

Low

Very High

Cross-account

Yes

Yes

Hybrid Connectivity

No

Yes

Central Routing

No

Yes

Route Tables

VPC only

Dedicated TGW tables

For 2–3 VPCs, peering may be enough. For enterprise environments with many VPCs, TGW is the preferred design.

Pricing model

Transit Gateway pricing has two main components:

Hourly charge per attachment

Data processing charge (per GB of traffic processed)

The account that owns the source attachment is typically charged, with options for flexible cost allocation.

Key Takeaways

Purpose: Centralized routing for AWS and hybrid networks.

Architecture: Hub-and-spoke instead of complex VPC peering.

Main Components: TGW, Attachments, Route Tables, Propagation.

Supports: VPC, VPN, Direct Connect, SD-WAN, Peering.

Best For: Enterprise, multi-account, and hybrid cloud networking.