The Solution: AWS Transit Gateway (TGW)

The Cloud Router

Think of a Transit Gateway like a major airport hub. Instead of every city operating direct flights to every other city (the full-mesh problem), all flights route through the hub. Adding a new city means adding one connection to the hub, not connections to every other city.

AWS Transit Gateway (TGW) is a regional, highly available, scalable cloud router. You attach your VPCs, VPN connections, and Direct Connect gateways to it as attachments. The TGW then routes traffic between any two attached networks, supporting transitive routing by design.

Hub-and-Spoke Architecture

• The Hub: The Transit Gateway itself, which maintains a TGW Route Table listing all known network destinations and which attachment to forward traffic to.
• The Spokes: VPC attachments, VPN attachments, Direct Connect Gateway attachments, and even peering attachments to TGWs in other regions or accounts.

Because TGW is a true router, it supports transitive routing. If VPC A and VPC B are both attached to the TGW, they can communicate through the hub without any direct peering connection between them.

TGW Route Tables and Segmentation

This is where TGW becomes genuinely powerful. You are not limited to a single flat route table where everyone can talk to everyone. You can create multiple TGW route tables and associate different attachments with different tables to enforce network segmentation.

Example: Isolating a Production environment

# TGW Route Table: "Production"
# Associated with: VPC-Prod attachment
# Propagates routes from: VPC-Prod, Shared-Services VPC
# Does NOT propagate routes from: VPC-Dev, VPC-Staging

# TGW Route Table: "Development"
# Associated with: VPC-Dev, VPC-Staging attachments
# Propagates routes from: VPC-Dev, VPC-Staging, Shared-Services VPC
# Does NOT propagate routes from: VPC-Prod

In this setup, Dev and Staging can reach Shared Services (logging, auth), but they cannot reach Production VPCs at all — even though all VPCs are attached to the same TGW.

Benefits of TGW

1. Simplified Management: One attachment per VPC instead of n-1 peering connections.
2. Centralized Routing Control: A single place to define and audit traffic flow between all networks.
3. Scalability: Supports up to 5,000 VPC attachments per TGW.
4. Cross-Account and Cross-Region: Share a TGW across AWS accounts using AWS Resource Access Manager (RAM), and peer TGWs across regions for global connectivity.

Cost model: You pay per attachment-hour and per GB of data processed through the TGW. For large-scale environments, this is almost always cheaper than the operational overhead of managing a full mesh.