What's changed: Deepened ANS-C01 Chapter 2 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
2.3Scaling Hybrid with Transit Gateway
Bundle at a hub—understand the Transit Gateway, segmentation via TGW route tables, DX/VPN attachments, and when to use it vs peering. Centrally bundle many VPCs and on-prem.
As VPCs and on-prem links grow, the Transit Gateway (TGW) becomes the hub. Connect each VPC, VPN, and DX as attachments, and control reachability via TGW route tables.
2.3.1Hub and segmentation
- Attachments: connect VPCs, VPN, DX (transit VIF), and other TGWs (peering) to the TGW.
- Transitive routing: unlike peering, attachments can reach each other through the TGW.
- TGW route tables: associate attachments to control reachability and segment (e.g., prod/dev).
- Choosing: a few 1:1 links → peering; many-to-hub + on-prem + segmentation → TGW.
Common on ANS-C01: bundle many VPCs + on-prem centrally = Transit Gateway, TGW is transitive (peering is not), segment with TGW route tables, and DX connects to TGW via a transit VIF. To separate prod and dev, use distinct TGW route tables.
TGWs can be peered to connect across regions. Large global networks are commonly bundled via inter-region TGW peering.
ANS-C01 TGW design probes "attachments, segmentation via route tables, scale, and choosing among models." A Transit Gateway is a regional hub bundling each VPC/VPN/DX (via transit VIF)/other TGW (peering) as attachments, providing transitive routing (unlike non-transitive peering). By associating attachments to TGW route tables and controlling learned routes via propagation, you achieve segmentation like "prod and dev cannot reach each other, but both reach a shared-services VPC" (hub-and-spoke, full mesh, isolation). Inter-region TGW peering builds cross-region global networks, and it supports multicast and centralized inspection via an appliance VPC (inspection VPC). It scales to thousands of VPCs, visualized with Network Manager. On cost/design: full-mesh peering breaks at N², so aggregate many via a TGW hub, though ultra-low-latency 1:1 heavy transfer can still favor peering; overlapping CIDRs are not allowed on a TGW either (work around with PrivateLink). The key is to nail "hub for many VPCs + on-prem = TGW (transitive)," "segment by controlling association/propagation in TGW route tables," "cross-region = TGW peering," and "DX connects via a transit VIF + DX Gateway."
| Requirement | Choice | Key point |
|---|---|---|
| Bundle many VPCs + on-prem | Transit Gateway | Transitive; aggregate via attachments |
| Separate prod/dev | TGW route tables | Segment via association/propagation |
| Cross-region | Inter-region TGW peering | Global network |
| A few 1:1 links | VPC peering | Non-transitive; low cost |
Scenario: Bundle three VPC groups (prod/dev/shared-services) plus on-prem; prevent prod↔dev traffic but allow both to reach shared services; and inspect all VPCs’ egress at a single firewall. → Use a Transit Gateway hub with separate TGW route tables for prod and dev (don’t propagate each other’s routes), propagating routes to the shared-services VPC to both. Centralize egress inspection by routing via an inspection VPC (Network Firewall/appliance) over TGW routes. Connect on-prem via a DX transit VIF + DX Gateway.
FAQ: Transit Gateway vs VPC peering? For a few (2 to several) 1:1 links where transitivity isn’t needed and cost matters, use peering. For many VPCs, with on-prem, transitive connectivity, segmentation, and centralized routing, use a Transit Gateway. Peering’s full mesh breaks at N², so aggregate to a TGW at scale. Neither allows overlapping CIDRs.
Exam trap: "Attaching prod and dev to a TGW automatically isolates them" is wrong—TGW attachments can reach each other by default, so you must use separate TGW route tables and control association/propagation to segment. Also, connecting overlapping-CIDR VPCs via a TGW is wrong (not allowed, like peering)—switch to single-service exposure via PrivateLink.
2.3.2Section summary
- Hub = Transit Gateway (transitive, includes on-prem)
- Isolation = segment via TGW route tables
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Bundle 20 VPCs plus on-prem and separate prod vs dev routing. Best choice?
Q2. Which correctly states the routing difference between VPC peering and Transit Gateway?
Q3. Connect Direct Connect to a Transit Gateway to reach many VPCs. What do you create?