Transit Gateway

Two ways to connect Amazon VPCs (and on-premises networks) to each other privately, over the AWS backbone — never the public internet.

• VPC Peering
  • A direct, one-to-one connection between two VPCs (same or different account/Region).
  • Traffic uses private IPs; simple and low-cost.
  • Not transitive — if A↔B and B↔C are peered, A still can’t reach C. Every pair needs its own peering.
  • CIDR ranges must not overlap.
  • Scales badly: n VPCs fully meshed = n(n-1)/2 connections.
• Transit Gateway
  • A central hub that connects many VPCs, AWS VPN, and AWS Direct Connect through one attachment each — a hub-and-spoke instead of a mesh.
  • Transitive by default; route tables on the gateway control which attachments can talk.
  • The scalable answer once you have more than a handful of VPCs.
• Rule of thumb
  • Two VPCs → peering. Many VPCs / hybrid network at scale → Transit Gateway.