Transit Gateway
AWS Transit Gateway provides a hub and spoke design for connecting VPCs and on-premises networks as a fully managed service without requiring you to provision virtual appliances like the Cisco CSRs. No VPN overlay is required, and AWS manages high availability and scalability.
Transit Gateway enables customers to connect thousands of VPCs. You can attach all your hybrid connectivity (VPN and Direct Connect connections) to a single Transit Gateway— consolidating and controlling your organization's entire AWS routing configuration in one place (Figure 4). Transit Gateway controls how traffic is routed among all the connected spoke networks using route tables. This hub and spoke model simplifies management and reduces operational costs because VPCs only connect to the Transit Gateway to gain access to the connected networks.
Figure 4 – Hub and Spoke design with AWS Transit Gateway
Transit Gateway is a Regional resource and can connect thousands of VPCs within the same AWS Region. You can create multiple Transit Gateways per Region, but Transit Gateways within an AWS Region cannot be peered, and you can connect to a maximum of three Transit Gateways over a single Direct Connect Connection for hybrid connectivity. For these reasons, you should restrict your architecture to just one Transit Gateway connecting all your VPCs in a given Region, and use Transit Gateway routing tables to isolate them wherever needed. There is a valid case for creating multiple Transit Gateways purely to limit misconfiguration blast radius.
Place your organization’s Transit Gateway in its Network Services
account. This enables centralized management by network engineers
who manage the Network services account. Use AWS Resource Access
Manager (RAM) to share a Transit Gateway for connecting VPCs
across multiple accounts in your AWS Organization within the same
Region. AWS RAM enables you to easily and securely share AWS
resources with any AWS account, or within your AWS Organization.
For more information, refer to the
Automating
AWS Transit Gateway attachments to a transit gateway in a central
account
