Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

Transit gateway or Direct Connect gateway

The names are similar and the two are frequently deployed together, but they solve different problems.

A Direct Connect gateway extends Direct Connect connections to VPCs in more than one Region. It is a fan-out point for a physical circuit, not a router: two VPCs behind the same Direct Connect gateway can each reach on-premises, but not each other.

A transit gateway is a general-purpose regional hub that routes between everything attached to it — VPCs, VPN connections and Direct Connect gateways — with route tables that let you decide what may reach what.

Use a transit gateway when

Section titled “Use a transit gateway when”
  • Several VPCs need to reach each other, especially across accounts.
  • You want hub-and-spoke rather than a mesh of peering connections.
  • Routing needs to be controlled at a granularity finer than “everything reaches everything”, using several route tables.
  • VPCs must reach more than one on-premises network.
  • You need multicast routing.
  • There are enough connections that centralised route management is worth paying for — it scales to thousands of attachments.

Use a Direct Connect gateway when

Section titled “Use a Direct Connect gateway when”
  • On-premises must reach VPCs through Direct Connect, and those VPCs are in more than one Region.
  • You want one set of virtual interfaces rather than one per VPC.
  • Compliance requires private connectivity, or the workload needs consistent bandwidth and latency that the public internet cannot promise.
  • Data transfer volumes make internet egress the dominant cost.

Using both

Section titled “Using both”

The common hybrid design uses both: a Direct Connect gateway terminates the circuits and associates with a transit gateway in each Region; the transit gateway routes between the VPCs. Traffic from on-premises enters through the Direct Connect gateway and is routed onwards by the transit gateway, which is what allows on-premises to reach every VPC and the VPCs to reach each other.

The relevant quotas: a Direct Connect gateway associates with up to 20 virtual private gateways or up to 6 transit gateways, and a transit gateway associates with up to 20 Direct Connect gateways. None of these can be increased.

graph TB subgraph OnPrem["On-Premises"] DC[Corporate Data Center] CR[Customer Router] end subgraph DXLoc["AWS Direct Connect Location"] DX[Direct Connect] subgraph VIFs["Private Virtual Interfaces"] VIF1["Private VIF 1<br/>VLAN 100<br/>BGP ASN 65001"] VIF2["Private VIF 2<br/>VLAN 200<br/>BGP ASN 65002"] end DXGW[Direct Connect Gateway] end subgraph R1["AWS Region - eu-west-2"] VPC1["VPC - Production<br/>CIDR: 10.0.0.0/16"] RT1["Route Table<br/>Routes to: 172.16.0.0/12"] end subgraph R2["AWS Region - eu-west-1"] VPC2["VPC - Development<br/>CIDR: 172.16.0.0/16"] RT2["Route Table<br/>Routes to: 10.0.0.0/8"] end DC --> CR CR --"10 Gbps connection"--> DX DX --> VIF1 & VIF2 VIF1 & VIF2 --"BGP session"--> DXGW DXGW --"Private connection"--> VPC1 DXGW --"Private connection"--> VPC2 VPC1 --- RT1 VPC2 --- RT2 classDef aws fill:#FF9900,stroke:#232F3E,stroke-width:2px,color:white; classDef corporate fill:#00A4EF,stroke:#232F3E,stroke-width:2px,color:white; classDef network fill:#1EC754,stroke:#232F3E,stroke-width:2px,color:white; classDef vif fill:#E6375A,stroke:#232F3E,stroke-width:2px,color:white; class VPC1,VPC2,DXGW,DX aws; class DC,CR corporate; class RT1,RT2 network; class VIF1,VIF2 vif;
Section titled “Related pages”