Example transit gateway routing tables
A worked example for a multi-account transit gateway with three VPCs. It shows the transit gateway’s own route table, the VPC route tables that feed it, and the decisions behind them.
The design allows every VPC to reach every other VPC through the transit gateway, keeps inter-VPC traffic off the public internet, and leaves room to add VPCs and Regions later.
The distinction that trips people up: a VPC subnet route table targets the transit gateway (tgw-…); the transit gateway’s own route tables target attachments (tgw-attach-…). Putting an attachment ID in a VPC route table produces an invalid gateway ID error.
Address plan
Section titled “Address plan”| VPC | Account | CIDR |
|---|---|---|
| VPC 1 | Account 1 | 10.1.0.0/16 |
| VPC 2 | Account 1 | 10.2.0.0/16 |
| VPC 3 | Account 2 | 10.3.0.0/16 |
Transit gateway route table
Section titled “Transit gateway route table”Route table tgw-rtb-main carries a route for every VPC CIDR block, each pointing at that VPC’s attachment.
| Destination CIDR | Target type | Target ID | Notes |
|---|---|---|---|
| 10.1.0.0/16 | Attachment | tgw-attach-vpc1 | Route to VPC 1 |
| 10.2.0.0/16 | Attachment | tgw-attach-vpc2 | Route to VPC 2 |
| 10.3.0.0/16 | Attachment | tgw-attach-vpc3 | Route to VPC 3 |
VPC route tables
Section titled “VPC route tables”VPC 1, rtb-vpc1-main
Section titled “VPC 1, rtb-vpc1-main”| Destination CIDR | Target | Notes |
|---|---|---|
| 10.1.0.0/16 | local | Local VPC traffic |
| 10.2.0.0/16 | tgw-xxxxxxxx | To VPC 2 via the transit gateway |
| 10.3.0.0/16 | tgw-xxxxxxxx | To VPC 3 via the transit gateway |
| 0.0.0.0/0 | igw-xxxxxxxx | Internet traffic, if the subnet is public |
VPC 2, rtb-vpc2-main
Section titled “VPC 2, rtb-vpc2-main”| Destination CIDR | Target | Notes |
|---|---|---|
| 10.2.0.0/16 | local | Local VPC traffic |
| 10.1.0.0/16 | tgw-xxxxxxxx | To VPC 1 via the transit gateway |
| 10.3.0.0/16 | tgw-xxxxxxxx | To VPC 3 via the transit gateway |
| 0.0.0.0/0 | igw-xxxxxxxx | Internet traffic, if the subnet is public |
VPC 3, rtb-vpc3-main
Section titled “VPC 3, rtb-vpc3-main”| Destination CIDR | Target | Notes |
|---|---|---|
| 10.3.0.0/16 | local | Local VPC traffic |
| 10.1.0.0/16 | tgw-xxxxxxxx | To VPC 1 via the transit gateway |
| 10.2.0.0/16 | tgw-xxxxxxxx | To VPC 2 via the transit gateway |
| 0.0.0.0/0 | igw-xxxxxxxx | Internet traffic, if the subnet is public |
Each of the three tables names the same transit gateway. A summary route such as 10.0.0.0/8 would work in place of the two specific entries, at the cost of losing the ability to leave one VPC out.
Transit gateway settings used here
Section titled “Transit gateway settings used here”| Setting | Value | Why |
|---|---|---|
| Auto-accept shared attachments | Enabled | Member accounts can attach without an approval step |
| Default route table association | Disabled | Attachments are associated explicitly, so isolation is deliberate |
| Default route table propagation | Disabled | Routes are added explicitly rather than appearing on their own |
| DNS support | Enabled | Cross-VPC resolution of private hosted zones |
| VPN ECMP support | Enabled | Aggregate bandwidth across multiple VPN tunnels |
| Default route table | tgw-rtb-main |
Disabling default association and propagation is what makes segmentation possible later: with them on, every attachment can reach every other attachment by default.
Attachments
Section titled “Attachments”- Each VPC has one transit gateway attachment.
- An attachment needs a subnet in each Availability Zone where traffic should enter or leave the transit gateway; other subnets in the same zone route through it.
- Attachments are associated with
tgw-rtb-main.
Growing the design
Section titled “Growing the design”Another VPC in the same Region
- Create the attachment.
- Add a route for the new CIDR block to the transit gateway route table and to the existing VPC route tables.
- Associate the attachment with the transit gateway route table.
Another Region
- Create a transit gateway in the target Region.
- Create a transit gateway peering attachment between the two.
- Add routes for the remote CIDR blocks in both Regions’ transit gateway route tables and in the VPC route tables.
Keep one non-overlapping block per Region so that a summary route per Region stays possible.
Security
Section titled “Security”- Routes make traffic possible; security groups and network ACLs decide whether it is allowed. Add both.
- Enable VPC flow logs on the attachment subnets — inter-VPC traffic is otherwise invisible.
- Give each account only the IAM and RAM permissions it needs to attach, not to alter the transit gateway route tables.
- Consider separate transit gateway route tables per environment rather than one shared table, so that a mistake in a development account cannot open a path to production.