Amazon Virtual Private Cloud
Transit Gateways

Getting Started with Transit Gateways

The following tasks help you become familiar with transit gateways. You will create a transit gateway and then connect two of your VPCs using the transit gateway.


  • To demonstrate a simple example of using a transit gateway, create two VPCs in the same Region. The VPCs cannot have overlapping CIDRs. Launch one EC2 instance in each VPC. For more information, see Working with VPCs and Subnets in the Amazon VPC User Guide.

  • You must enable resource sharing from the master account for your organization. For information about enabling resource sharing, see Enable Sharing with AWS Organizations in the AWS RAM User Guide.

  • You cannot have identical routes pointing to two different VPCs. A transit gateway does not propagate the CIDRs of a newly attached VPC if an identical route exists in the transit gateway route tables.

  • Verify that you have the permissions required to work with transit gateways. For more information, see Authentication and Access Control for Your Transit Gateways.

Step 1: Create the Transit Gateway

When you create a transit gateway, we create a default transit gateway route table and use it as the default association route table and the default propagation route table.

To create a transit gateway

  1. Open the Amazon VPC console at

  2. In the Region selector, choose the Region that you used when you created the VPCs.

  3. On the navigation pane, choose Transit Gateways.

  4. Choose Create Transit Gateway.

  5. (Optional) For Name tag, type a name for the transit gateway. This creates a tag with "Name" as the key and the name that you specified as the value.

  6. (Optional) For Description, type a description for the transit gateway.

  7. For Amazon side ASN, type the private Autonomous System Number (ASN) for your transit gateway. This should be the ASN for the AWS side of a Border Gateway Protocol (BGP) session.

    The range is 64512 to 65534 for 16-bit ASNs.

    The range is 4200000000 to 4294967294 for 32-bit ASNs.

    If you have a multi-region deployment, we recommend that you use a unique ASN for each of your transit gateways.

  8. (Optional) You can modify the default settings if you need to disable DNS support, or if you don't want the default association route table or default propagation route table.

  9. Choose Create Transit Gateway.

  10. After you see the message Create Transit Gateway request succeeded, choose Close. The initial state of the transit gateway is pending.

Step 2: Attach Your VPCs to Your Transit Gateways

Wait until the transit gateway you created in the previous section shows as available before proceeding with creating an attachment. Create an attachment for each VPC.

Confirm that you have created two VPCs and launched an EC2 instance in each, as described in Prerequisites.

Create a Transit Gateway Attachment to a VPC

  1. Open the Amazon VPC console at

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Choose Create Transit Gateway Attachment.

  4. For Transit Gateway ID, choose the transit gateway to use for the attachment.

  5. For Attachment type, choose VPC.

  6. (Optional) For Attachment name tag, type a name for the attachment.

  7. Choose whether to enable DNS support. For this exercise, do not enable IPv6 support.

  8. For VPC ID, choose the VPC to attach to the transit gateway.

  9. For Subnet IDs, select one subnet for each Availability Zone to be used by the transit gateway to route traffic. You must select at least one subnet. You can select only one subnet per Availability Zone.

  10. Choose Create attachment.

Each attachment is always associated with exactly one route table. Route tables can be associated with zero to many attachments.

Step 3: Add Routes between the Transit Gateway and your VPCs

A route table includes dynamic and static routes that determine the next hop for associated VPCs based on the destination IP address of the packet.

To add a route to a VPC route table

  1. Open the Amazon VPC console at

  2. On the navigation pane, choose Route Tables.

  3. Choose the route table associated with your VPC.

  4. Choose the Routes tab, then choose Edit routes.

  5. Choose Add route.

  6. In the Destination column, enter the destination IP address range. For Target, choose the transit gateway that you used to create the transit gateway attachment.

  7. Choose Save routes, then choose Close.

Step 4: Testing the Transit Gateway

You can confirm that the transit gateway was successfully created by connecting to an EC2 instance in each VPC, and then sending data between them, such as a ping command. For more information, see Connect to Your Linux Instance or Connecting to Your Windows Instance.

Step 5: Delete the Transit Gateway

When you no longer need a transit gateway, you can delete it. You cannot delete a transit gateway that has resource attachments. As soon as the transit gateway is deleted, you stop incurring charges for it.

To delete your transit gateway

  1. Open the Amazon VPC console at

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Select the attachments and then choose Actions, Delete. When prompted for confirmation, choose Delete.

  4. On the navigation pane, choose Transit Gateways.

  5. Select the transit gateway and then choose Actions, Delete. When prompted for confirmation, choose Delete.