AWS Transit Gateway

Networking & Content Delivery

Regional hub-and-spoke router that connects VPCs, VPNs, and Direct Connect through one gateway instead of a peering mesh.

Verified against AWS documentation · 2026-08-24

Key facts

  1. 01Regional and highly available by design — attach once, route everywhere; VPC peering never routes through a middle VPC
  2. 02Each attachment associates with one TGW route table but can propagate into many — this is how prod and dev stay isolated on a single gateway
  3. 03Does not fix overlapping CIDRs, and security group references don't cross the gateway between spokes
  4. 04Limits: 5,000 attachments, 10,000 routes, 20 route tables per TGW; 50 Gbps burst per VPC attachment

Exam triggers

Phrases and scenarios that point here.

  • "Hundreds of VPCs", "simplify the peering mesh", "central hub", "transitive routing"
  • One Direct Connect or VPN shared by every VPC → attach it to the TGW, not a VGW per VPC
  • Dev and prod must both reach shared services but never each other → multiple TGW route tables, one gateway
  • Private connectivity between two Regions → TGW peering attachment (static routes only, no BGP)

Not this service

  • Expose one service to many consumers, or the CIDRs overlap → PrivateLink
  • Two VPCs, stable topology, heavy traffic → VPC peering (no hourly charge, no per-GB processing)

Use cases

  1. 01Killing a peering mesh — at 10 VPCs you're maintaining 45 connections and every new account means 10 more route table edits; one attachment per VPC ends that
  2. 02Shared services hub, where DNS resolvers, domain controllers, and patch/artifact repos sit in one VPC every workload reaches while the workload VPCs stay invisible to each other
  3. 03Hybrid consolidation — one Direct Connect gateway plus a backup Site-to-Site VPN on the TGW serves the whole estate, instead of a virtual private gateway and tunnel pair per VPC
  4. 04Centralized egress and inspection, where spokes default-route to a single firewall/NAT VPC so you run one NAT Gateway pair instead of one per VPC (appliance mode keeps flows symmetric across AZs)
  5. 05Multi-Region DR — peer the TGWs in each Region so failover VPCs and on-premises stay reachable over the AWS backbone without standing up new tunnels

How it's charged

  1. 01Two dimensions: roughly $0.05 per attachment-hour (~$36/month) and $0.02/GB processed in most Regions — the hourly charge accrues on a completely idle attachment
  2. 02Data processing is billed once, on the way into the TGW from a VPC, VPN, Direct Connect, or Network Firewall attachment — not again on the way out
  3. 03Attachment hours bill to the attachment owner: VPC owner for VPC attachments, TGW owner for VPN and Connect, Direct Connect gateway owner for DX — so the central network team often never sees the cost
  4. 04Peering attachments: both TGW owners pay hourly, the receiving side pays no data processing, and inter-Region traffic still pays data transfer out — about $0.04 per cross-Region GB
  5. 05Cost trap: hairpinning through a central inspection VPC bills the same GB twice (spoke → TGW, then inspection VPC → TGW); for two chatty high-volume VPCs, peering has neither charge

Commonly confused with

AWS PrivateLinkNetworking & Content DeliveryAWS Direct ConnectNetworking & Content Delivery

References