What's changed: Service coverage: added a catalog section (s4) for governance/security/end-user services
1.3Multi-Account and Hybrid Networking
Understand large-scale connectivity—Transit Gateway, VPC peering, PrivateLink, Direct Connect, Site-to-Site VPN, and Route 53 Resolver. Interconnect many VPCs and on-premises efficiently.
As VPCs grow, a full mesh of peering breaks down. Use a Transit Gateway as a hub to connect many VPCs and on-premises in a star topology.
1.3.1Choosing connectivity
- Transit Gateway: connects many VPCs and on-premises in a hub-and-spoke, eliminating full-mesh peering.
- VPC peering: connects two VPCs one-to-one (no transitive routing); simple for a few.
- PrivateLink: exposes a service via a private IP (interface endpoint) for secure cross-VPC consumption.
- Direct Connect / VPN: on-prem connectivity. Direct Connect = dedicated (low-latency/stable), Site-to-Site VPN = encrypted (quick/backup); combining both is common.
Common on SAP-C02: hub for many VPCs/on-prem = Transit Gateway, two VPCs one-to-one = peering (non-transitive), private service exposure = PrivateLink, dedicated = Direct Connect, encrypted/backup = VPN. A classic design pairs Direct Connect with a Site-to-Site VPN backup.
VPC peering is non-transitive (A-B and B-C do not enable A-C). For many interconnected VPCs, use a Transit Gateway.
Choose connectivity by scale and requirement. A few 1:1 links use VPC peering (non-transitive, low cost, same/cross-region); many VPCs + on-prem use a Transit Gateway (hub-and-spoke; isolate via route tables; cross-region via peering attachments; bandwidth per attachment). One-directional “provider” exposure uses PrivateLink (publish behind an NLB as an endpoint service; consumers use an interface endpoint—works even with overlapping CIDRs; one-way). On-prem uses Direct Connect (dedicated, low-latency/stable; Public/Private/Transit VIFs; redundancy via multiples or a LAG) as primary with Site-to-Site VPN as backup (IPsec, quick, cheap); VPN over Direct Connect combines encryption with the dedicated link. For DNS, Route 53 Resolver (inbound/outbound endpoints + forwarding rules) makes on-prem⇔VPC resolution mutual. At scale: “place the TGW in a network account and share via RAM,” “DX + VPN failover,” and “avoid overlapping CIDRs with PrivateLink/private NAT” are standard.
| Need | Choose | Notes |
|---|---|---|
| Many VPCs + on-prem | Transit Gateway | Hub-and-spoke; route-table isolation |
| Two VPCs 1:1 | VPC peering | Non-transitive, low cost |
| Privately offer a service | PrivateLink | One-way; overlapping CIDR ok |
| Dedicated on-prem | Direct Connect (+ VPN) | Low-latency/stable; VPN backup |
Scenario: centralize a Transit Gateway in a network account to connect 20 VPCs and two on-prem sites, with a dedicated primary link failing over to an encrypted path. → Create the TGW in the network account, share it via AWS RAM, and attach each VPC. Use Direct Connect (Transit VIF) as primary and a Site-to-Site VPN as backup, with BGP for automatic failover.
FAQ: Q. Connect VPCs with overlapping CIDRs? → A. Peering/TGW can’t with overlap; for service exposure use PrivateLink (overlap-OK, one-way) or private NAT. Q. Is Direct Connect alone enough? → A. A single DX has no failover; pair it with a Site-to-Site VPN for failover.
Trap: “a Transit Gateway can route between VPCs with overlapping CIDRs” is wrong—TGW/peering can’t handle overlap (use PrivateLink or private NAT). Also “Direct Connect is an encrypted dedicated link” is wrong—DX itself isn’t encrypted; add MACsec or VPN over DX if needed.
1.3.2Section summary
- Many = Transit Gateway (hub-and-spoke) / few = peering
- On-prem = Direct Connect (dedicated) + VPN (backup) / private exposure = PrivateLink
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You must interconnect 50 VPCs and several on-premises sites, avoiding full-mesh peering. Best service?
Q2. You want customers to consume your SaaS privately from their VPC without traversing the internet. What?
Q3. You want a low-latency, stable dedicated link as primary on-prem connectivity, with an encrypted VPN as backup. What is the primary?