What's changed: Service coverage: added a catalog section (s4) for governance/security/end-user services
1.3Multi-Account and Hybrid Networking
Understand large-scale connectivity—Transit Gateway, VPC peering, PrivateLink, Direct Connect, Site-to-Site VPN, and Route 53 Resolver. Interconnect many VPCs and on-premises efficiently.
As VPCs grow, a full mesh of peering breaks down. Use a Transit Gateway as a hub to connect many VPCs and on-premises in a star topology.
1.3.1Choosing connectivity
- Transit Gateway: connects many VPCs and on-premises in a hub-and-spoke, eliminating full-mesh peering.
- VPC peering: connects two VPCs one-to-one (no transitive routing); simple for a few.
- PrivateLink: exposes a service via a private IP (interface endpoint) for secure cross-VPC consumption.
- Direct Connect / VPN: on-prem connectivity. Direct Connect = dedicated (low-latency/stable), Site-to-Site VPN = encrypted (quick/backup); combining both is common.
Common on SAP-C02: hub for many VPCs/on-prem = Transit Gateway, two VPCs one-to-one = peering (non-transitive), private service exposure = PrivateLink, dedicated = Direct Connect, encrypted/backup = VPN. A classic design pairs Direct Connect with a Site-to-Site VPN backup.
VPC peering is non-transitive (A-B and B-C do not enable A-C). For many interconnected VPCs, use a Transit Gateway.
Choose connectivity by scale and requirement. A few 1:1 links use VPC peering (non-transitive, low cost, same/cross-region); many VPCs + on-prem use a Transit Gateway (hub-and-spoke; isolate via route tables; cross-region via peering attachments; bandwidth per attachment). One-directional “provider” exposure uses PrivateLink (publish behind an NLB as an endpoint service; consumers use an interface endpoint—works even with overlapping CIDRs; one-way). On-prem uses Direct Connect (dedicated, low-latency/stable; Public/Private/Transit VIFs; redundancy via multiples or a LAG) as primary with Site-to-Site VPN as backup (IPsec, quick, cheap); VPN over Direct Connect combines encryption with the dedicated link. For DNS, Route 53 Resolver (inbound/outbound endpoints + forwarding rules) makes on-prem⇔VPC resolution mutual. At scale: “place the TGW in a network account and share via RAM,” “DX + VPN failover,” and “avoid overlapping CIDRs with PrivateLink/private NAT” are standard.
| Need | Choose | Notes |
|---|---|---|
| Many VPCs + on-prem | Transit Gateway | Hub-and-spoke; route-table isolation |
| Two VPCs 1:1 | VPC peering | Non-transitive, low cost |
| Privately offer a service | PrivateLink | One-way; overlapping CIDR ok |
| Dedicated on-prem | Direct Connect (+ VPN) | Low-latency/stable; VPN backup |
Scenario: centralize a Transit Gateway in a network account to connect 20 VPCs and two on-prem sites, with a dedicated primary link failing over to an encrypted path. → Create the TGW in the network account, share it via AWS RAM, and attach each VPC. Use Direct Connect (Transit VIF) as primary and a Site-to-Site VPN as backup, with BGP for automatic failover.
FAQ: Q. Connect VPCs with overlapping CIDRs? → A. Peering/TGW can’t with overlap; for service exposure use PrivateLink (overlap-OK, one-way) or private NAT. Q. Is Direct Connect alone enough? → A. A single DX has no failover; pair it with a Site-to-Site VPN for failover.
Trap: “a Transit Gateway can route between VPCs with overlapping CIDRs” is wrong—TGW/peering can’t handle overlap (use PrivateLink or private NAT). Also “Direct Connect is an encrypted dedicated link” is wrong—DX itself isn’t encrypted; add MACsec or VPN over DX if needed.
1.3.2Section summary
- Many = Transit Gateway (hub-and-spoke) / few = peering
- On-prem = Direct Connect (dedicated) + VPN (backup) / private exposure = PrivateLink
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You must interconnect 50 VPCs and several on-premises sites, avoiding full-mesh peering. Best service?
Q2. You want customers to consume your SaaS privately from their VPC without traversing the internet. What?
Q3. You want a low-latency, stable dedicated link as primary on-prem connectivity, with an encrypted VPN as backup. What is the primary?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.