Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

Virtual private gateways

A virtual private gateway (VGW) is the AWS-side endpoint of a Site-to-Site VPN connection or a Direct Connect private virtual interface. It attaches to exactly one VPC.

Its resource ID prefix is vgw-.

It belongs to one account

Section titled “It belongs to one account”

A virtual private gateway is created in, billed to and managed by a single AWS account, and is visible only to that account.

AWS account 123456789012
├── VPC:     vpc-0123456789abcdef0
├── VGW:     vgw-0123456789abcdef0   ← belongs to this account
└── Subnets, route tables, and so on

It cannot be shared

Section titled “It cannot be shared”

Unlike a transit gateway, a virtual private gateway is not a resource that AWS Resource Access Manager can share. Account A’s gateway cannot be used by account B.

For cross-account hybrid connectivity that means each account needs its own gateway and its own virtual interface or VPN connection:

Account A
├── VPC-A (10.0.0.0/16)
├── VGW-A (vgw-aaaa)
└── Direct Connect private VIF → VGW-A


Account B
├── VPC-B (10.1.0.0/16)
├── VGW-B (vgw-bbbb)
└── Direct Connect private VIF → VGW-B

A Direct Connect gateway removes some of this duplication — it associates with up to 20 virtual private gateways, including gateways in other accounts and Regions, behind one set of virtual interfaces. But each VPC still needs its own virtual private gateway.

When to use a transit gateway instead

Section titled “When to use a transit gateway instead”

Beyond a small number of VPCs, attaching every one to its own virtual private gateway becomes hard to manage: one virtual interface or VPN connection per VPC, one set of routes per VPC, and no path between the VPCs themselves.

A transit gateway replaces the whole arrangement with one attachment per VPC into a shared hub, and can be shared across accounts with Resource Access Manager. It is also the only one of the two that supports routing between the attached VPCs.

Route propagation

Section titled “Route propagation”

Enabling route propagation on a route table lets the attached virtual private gateway install the routes it learns over BGP automatically, and withdraw them when the session drops — which is what makes VPN and Direct Connect failover work without manual edits. See route tables.

Section titled “Related pages”