Transit Gateway
AWS Transit Gateway connects VPCs, VPN connections and Direct Connect gateways through a single regional hub. It behaves like a cloud router: each network is attached once, and the transit gateway’s route tables decide what can reach what. That replaces the mesh of point-to-point peering connections that otherwise grows quadratically with the number of VPCs.
Key properties
Section titled “Key properties”- Transitive routing between attached networks. Unlike VPC peering, traffic can pass through the hub from one attachment to another.
- Hub-and-spoke by design; segmentation comes from using multiple transit gateway route tables rather than from separate gateways.
- Regional. Transit gateways in different Regions are joined with peering attachments.
- Shareable across accounts with AWS Resource Access Manager, so one network account can own the gateway and member accounts attach to it.
- Works with Site-to-Site VPN and with Direct Connect through a Direct Connect gateway and a transit virtual interface.
- Supports IP multicast, which VPC peering and Direct Connect do not.
- Supports Transit Gateway Connect attachments, which carry GRE tunnels to third-party SD-WAN appliances at higher bandwidth than a VPN attachment.
Quotas worth knowing
Section titled “Quotas worth knowing”| Quota | Default | Adjustable |
|---|---|---|
| Transit gateways per account per Region | 5 | Yes |
| Attachments per transit gateway | 5,000 | Yes |
| Transit gateways a single VPC can attach to | 5 | No |
| Peering attachments per transit gateway | 50 | Yes |
| Route tables per transit gateway | 20 | Yes |
| Total routes across all route tables on one transit gateway | 10,000 | On request |
| Bandwidth per VPC attachment per Availability Zone | Up to 100 Gbps each direction | On request |
| Bandwidth per Connect peer (GRE tunnel) | Up to 5 Gbps | No |
| Direct Connect gateways per transit gateway | 20 | No |
| Transit gateways per Direct Connect gateway | 6 | No |
The MTU is 8,500 bytes for VPC, Direct Connect, Connect and peering attachments, and 1,500 bytes over VPN.
Note the first row in particular: several transit gateways per Region is normal, and separating production from non-production is a common reason to have more than one.
Transit gateway or transit VPC
Section titled “Transit gateway or transit VPC”A transit VPC builds the same hub from EC2 instances running third-party routing or VPN software. It predates Transit Gateway and is now the fallback rather than the default.
| Transit VPC | Transit Gateway | |
|---|---|---|
| Operation | You run, patch and monitor the appliance instances | Fully managed |
| Scaling | Bounded by the instance types you chose | Scales without intervention |
| Bandwidth | Instance-dependent | Up to 100 Gbps per VPC attachment per Availability Zone |
| Routing | Managed on the appliances | Transit gateway route tables, with multiple tables for segmentation |
| Cost | EC2 instances plus vendor licences plus data | Attachment-hours plus data processed |
| Cross-Region | Built by the appliances | Peering attachments |
| Multicast | Depends on the appliance | Supported natively |
A transit VPC is still defensible when you need a specific vendor feature — a particular firewall’s inspection or routing policy engine — or when you are heavily invested in an existing deployment that works. For new designs, Transit Gateway is the default.
Note that inspection appliances no longer require a transit VPC either: a Gateway Load Balancer puts third-party appliances in a traffic path without making them the router.
Connecting to other clouds
Section titled “Connecting to other clouds”Site-to-Site VPN. Terminate an IPsec VPN on the transit gateway from Google Cloud, Microsoft Azure, Oracle Cloud or IBM Cloud. Straightforward, and bounded by VPN tunnel bandwidth unless you aggregate tunnels with ECMP.
Transit Gateway Connect. Attach a third-party SD-WAN or virtual router appliance over GRE, with higher bandwidth and lower latency than a VPN attachment, and BGP for routing.
Direct Connect. Where a partner has presence in more than one cloud, a Direct Connect circuit into a transit gateway gives the most predictable performance.
Whichever you choose, plan the address space first — overlapping private ranges between clouds cannot be routed — and expect cross-Region traffic and inter-cloud data transfer to appear on the bill.
IP multicast
Section titled “IP multicast”Multicast sends one copy of a stream that the network replicates only where it is needed, instead of one copy per recipient (unicast) or a copy to everybody on the segment (broadcast). Streaming 1,000 receivers costs one stream from the source rather than 1,000.
- Multicast group addresses are 224.0.0.0 to 239.255.255.255 for IPv4.
- Receivers join and leave groups with IGMP.
- Routers build distribution trees so traffic only reaches segments with interested receivers.
Typical uses are live video distribution, market data feeds, and software distribution to many hosts at once.
Transit gateway multicast has its own limits — throughput per flow is capped at 1 Gbps and aggregate throughput per Availability Zone at 20 Gbps — so it is not a fit for high-frequency trading or other latency-critical distribution. Check the multicast quotas before committing to a design.