We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Cloud Infrastructure
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Cloud Infrastructure
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
With 5 VPCs, you need 10 peering connections. With 10 VPCs, 45. With 50 VPCs, 1,225. Each connection has its own route table entries, security rules, and management overhead. This does not scale.
AWS Transit Gateway solves this with a hub-and-spoke model. Instead of connecting every VPC to every other VPC, you connect each VPC to a central Transit Gateway. The gateway handles routing between all attached networks. Add a new VPC? Connect it to the Transit Gateway. Done. It can immediately reach all other attached VPCs, no need to create individual peering connections.
Transit Gateway supports VPCs, VPN connections, Direct Connect gateways, and even other Transit Gateways (for inter-region connectivity). It is the networking backbone for enterprise cloud architectures. Capital One's migration to AWS involved connecting over 100 VPCs across multiple accounts and regions. They used Transit Gateway as their central hub, reducing their network management overhead by over 80% compared to the mesh of peering connections they would have needed otherwise.
Hub-and-spoke model:
Key capabilities:
| Feature | Detail |
|---|---|
| Attachments | VPC, VPN, Direct Connect, peering (inter-region) |
| Route tables | Multiple route tables for traffic isolation |
| Up to 50 Gbps per VPC attachment | |
| Cross-region | Transit Gateway peering between regions |
| Cross-account | Share via AWS Resource Access Manager |
| Cost | $0.05/hr per attachment + $0.02/GB data |
Route table isolation: You can create multiple route tables on a Transit Gateway to control which VPCs can communicate. Production VPCs might share one route table. Dev VPCs share another. The shared-services VPC is in both. This gives you connectivity where needed and isolation where required.
Cost reality: Transit Gateway is not cheap. 10 VPC attachments = $0.50/hr = $365/month just for attachments, plus data transfer at $0.02/GB. For 2-3 VPCs, individual peering is cheaper and simpler. Transit Gateway pays off at 5+ VPCs or when you need centralized routing control.
Bandwidth: Each VPC attachment supports up to 50 Gbps burst. But be aware of the aggregate limit: a single Transit Gateway handles up to 50 Gbps total across all attachments. For higher , you can use multiple Transit Gateways or ECMP (Equal-Cost Multi-Path) with VPN attachments.