What's changed: Deepened ANS-C01 Chapter 2 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
2.3Scaling Hybrid with Transit Gateway
Bundle at a hub—understand the Transit Gateway, segmentation via TGW route tables, DX/VPN attachments, and when to use it vs peering. Centrally bundle many VPCs and on-prem.
As VPCs and on-prem links grow, the Transit Gateway (TGW) becomes the hub. Connect each VPC, VPN, and DX as attachments, and control reachability via TGW route tables.
2.3.1Hub and segmentation
- Attachments: connect VPCs, VPN, DX (transit VIF), and other TGWs (peering) to the TGW.
- Transitive routing: unlike peering, attachments can reach each other through the TGW.
- TGW route tables: associate attachments to control reachability and segment (e.g., prod/dev).
- Choosing: a few 1:1 links → peering; many-to-hub + on-prem + segmentation → TGW.
Common on ANS-C01: bundle many VPCs + on-prem centrally = Transit Gateway, TGW is transitive (peering is not), segment with TGW route tables, and DX connects to TGW via a transit VIF. To separate prod and dev, use distinct TGW route tables.
TGWs can be peered to connect across regions. Large global networks are commonly bundled via inter-region TGW peering.
ANS-C01 TGW design probes "attachments, segmentation via route tables, scale, and choosing among models." A Transit Gateway is a regional hub bundling each VPC/VPN/DX (via transit VIF)/other TGW (peering) as attachments, providing transitive routing (unlike non-transitive peering). By associating attachments to TGW route tables and controlling learned routes via propagation, you achieve segmentation like "prod and dev cannot reach each other, but both reach a shared-services VPC" (hub-and-spoke, full mesh, isolation). Inter-region TGW peering builds cross-region global networks, and it supports multicast and centralized inspection via an appliance VPC (inspection VPC). It scales to thousands of VPCs, visualized with Network Manager. On cost/design: full-mesh peering breaks at N², so aggregate many via a TGW hub, though ultra-low-latency 1:1 heavy transfer can still favor peering; overlapping CIDRs are not allowed on a TGW either (work around with PrivateLink). The key is to nail "hub for many VPCs + on-prem = TGW (transitive)," "segment by controlling association/propagation in TGW route tables," "cross-region = TGW peering," and "DX connects via a transit VIF + DX Gateway."
| Requirement | Choice | Key point |
|---|---|---|
| Bundle many VPCs + on-prem | Transit Gateway | Transitive; aggregate via attachments |
| Separate prod/dev | TGW route tables | Segment via association/propagation |
| Cross-region | Inter-region TGW peering | Global network |
| A few 1:1 links | VPC peering | Non-transitive; low cost |
Scenario: Bundle three VPC groups (prod/dev/shared-services) plus on-prem; prevent prod↔dev traffic but allow both to reach shared services; and inspect all VPCs’ egress at a single firewall. → Use a Transit Gateway hub with separate TGW route tables for prod and dev (don’t propagate each other’s routes), propagating routes to the shared-services VPC to both. Centralize egress inspection by routing via an inspection VPC (Network Firewall/appliance) over TGW routes. Connect on-prem via a DX transit VIF + DX Gateway.
FAQ: Transit Gateway vs VPC peering? For a few (2 to several) 1:1 links where transitivity isn’t needed and cost matters, use peering. For many VPCs, with on-prem, transitive connectivity, segmentation, and centralized routing, use a Transit Gateway. Peering’s full mesh breaks at N², so aggregate to a TGW at scale. Neither allows overlapping CIDRs.
Exam trap: "Attaching prod and dev to a TGW automatically isolates them" is wrong—TGW attachments can reach each other by default, so you must use separate TGW route tables and control association/propagation to segment. Also, connecting overlapping-CIDR VPCs via a TGW is wrong (not allowed, like peering)—switch to single-service exposure via PrivateLink.
2.3.2Section summary
- Hub = Transit Gateway (transitive, includes on-prem)
- Isolation = segment via TGW route tables
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Bundle 20 VPCs plus on-prem and separate prod vs dev routing. Best choice?
Q2. Which correctly states the routing difference between VPC peering and Transit Gateway?
Q3. Connect Direct Connect to a Transit Gateway to reach many VPCs. What do you create?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.