AWS Transit Gateway

A regional managed network transit hub that centralises and simplifies connectivity between multiple Amazon VPCs, on‑premises networks, and edge attachments. It operates as a managed routing plane where customers create attachments and route tables to control traffic flows. It normally fits between VPCs, Direct Connect, and VPN connections to provide transitive connectivity and centralized routing control.

🗂 Resource Category

Networking and Content Delivery

🧠 Exam Memory Hook

Think: "Many VPCs + central routing + hybrid connectivity = AWS Transit Gateway"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the Transit Gateway control plane and underlying physical infrastructure, the managed routing platform, and service availability for the regional Transit Gateway resource. AWS secures and patches the service platform and the infrastructure that runs the Transit Gateway. AWS provides the management APIs, console, and service-side telemetry for the Transit Gateway itself.

Customer responsibilities: The customer configures attachments, route table associations and propagation, security controls (security groups, network ACLs, and appliance configurations), IAM permissions, monitoring and logging, and any network appliances or EC2 instances in connected VPCs. The customer secures and monitors traffic traversing attachments, manages on-premises devices and Direct Connect/VPN endpoints, and implements end-to-end network segmentation and inspection.

Patching responsibilities: AWS patches and maintains the Transit Gateway service platform and the underlying physical infrastructure. There is no guest operating system or hypervisor for customers to patch within the managed Transit Gateway; customers remain responsible for patching guest operating systems, runtimes, libraries, dependencies, and applications on EC2 instances, network appliances, or other compute resources in their VPCs or on-premises networks.

🏗 Typical Architecture

💡 Top 5 Features

Centralised routing hub that provides transitive connectivity between multiple VPCs and on-premises networks through attachments.
Route tables and route propagation that let customers control which attachments can communicate with each other.
Integration with AWS Direct Connect and AWS Site-to-Site VPN for hybrid connectivity to on-premises networks.
Transit Gateway Connect feature for integrating SD-WAN appliances and third-party virtual appliances using GRE or VXLAN.
Inter-region Transit Gateway peering to connect Transit Gateways across AWS regions when configured.

✅ Top 5 Use Cases

Centralising and simplifying network topology for large AWS estates by connecting many VPCs and accounts through one managed hub.
Providing hybrid connectivity by aggregating Direct Connect and Site-to-Site VPN links into a single routing plane.
Consolidating network services such as NAT, firewall, or inspection appliances by attaching inspection VPCs to the Transit Gateway.
Integrating branch SD-WAN solutions with AWS workloads using Transit Gateway Connect for high-scale appliance connectivity.
Enabling controlled inter-region application traffic using Transit Gateway peering instead of mesh VPC peering when regional separation is required.

🏗 Architecture Placement

AWS Transit Gateway is a regional, managed routing hub that sits between VPCs and external network endpoints; VPC attachments, Direct Connect, and VPN connections send traffic to it. It connects to VPC route tables and other attachments via Transit Gateway route tables that the customer configures. Inter-region peering can be used when cross-region connectivity is required. It does not replace VPC-level security controls or customer-managed appliances unless those functions are explicitly attached and configured.

🎯 Commonly Used With

- Amazon VPC
- AWS Direct Connect
- AWS Site-to-Site VPN
- Amazon CloudWatch
- AWS Resource Access Manager

🌍 5 Real-World Examples

A bank centralises connectivity for dozens of production and non-production VPCs to enforce consistent routing and connect to on-premises data centres for core banking systems.
A healthcare provider aggregates Direct Connect circuits and VPN links into a Transit Gateway to provide a single routing plane for EHR systems and analytics VPCs.
A retail company attaches a security inspection VPC to a Transit Gateway so that ingress and egress traffic from multiple storefront VPCs is routed through managed firewall appliances.
A telecommunications operator integrates branch SD-WAN appliances with AWS workloads using Transit Gateway Connect to simplify branch-to-cloud connectivity.
A media company uses Transit Gateway peering to link rendering and asset-storage VPCs across regions while maintaining regional routing control.

🎓 AWS Exam Clues

Consider Transit Gateway when you need centralised transitive routing between many VPCs and on-premises networks.
Choose Transit Gateway for hybrid architectures that aggregate Direct Connect and Site-to-Site VPN connectivity into a single hub.
Use Transit Gateway route tables and propagation when exam text emphasises scalable route control and selective attachment communication.
Be mindful of traffic flow and potential data transfer costs when exam scenarios mention high inter-VPC or egress bandwidth.
When the question requires sharing network connectivity across accounts, look for resource-sharing with AWS Resource Access Manager.

📝 Quick Revision

AWS Transit Gateway provides a regional, managed routing hub to centralise connectivity between VPCs and hybrid networks. Use it when you need transitive routing, centralized route control, and integrations with Direct Connect or VPN; consider route table design, security appliance placement, and sharing across accounts.

🏷 Keywords

Transit Gateway • VPC attachment • Transit Gateway route table • Route propagation • Direct Connect • Site-to-Site VPN • Transit Gateway Connect • Inter-region peering • AWS Resource Access Manager • Centralised routing • Inspection VPC • Attachment association