The building blocks of Transit Gateway
So far, you've learned:
Now let's understand the pieces that make Transit Gateway work.
Think of Transit Gateway like LEGO blocks. You need to understand each piece before you can build something useful. Let's break down the 4 core components.
What it is: A highly available, scalable virtual router managed by AWS.
What it does: Routes traffic between attached networks when permitted by Transit Gateway route tables and VPC routing configuration.
Creating a Transit Gateway:
When you create a Transit Gateway in AWS, you configure a few basic settings:
Important: A default route table may be created at Transit Gateway creation, depending on your default association/propagation settings. If both "Default Route Table Association" and "Default Route Table Propagation" are disabled, no default route table is created.
Think of the Transit Gateway like a physical network switch in a data center.
You buy the switch (create the TGW), configure some basic settings (ASN, DNS), and then you start plugging cables into it (attachments). The switch routes traffic between all the connected devices.
Important: The Transit Gateway itself is regional. If you create a Transit Gateway in us-east-1, it only works in us-east-1. To connect multiple regions, you need one Transit Gateway per region and connect them with Inter-Region Peering.
There are several types of attachments you can create:
Connects a VPC to the Transit Gateway. This is the most common type.
📖 Coming Up: We'll dive deep into VPC Attachments in Topic 2 - including subnet selection, availability zones, and ENI planning.
Connects your on-premises network via Site-to-Site VPN.
📖 Coming Up: We'll explore VPN Attachments in detail in Topic 3 - including BGP configuration, ECMP, and when to use VGW vs TGW VPN.
A Transit Gateway attaches to a Direct Connect Gateway, which provides connectivity to on-premises networks via Direct Connect.
📖 Coming Up: Direct Connect integration is covered in Topic 4 - including Transit VIF setup and DX Gateway configuration.
Connects two Transit Gateways together (in the same or different regions).
📖 Coming Up: Inter-Region Peering is explained in Topic 9 - including peering setup and multi-region design patterns.
Route tables are where the actual routing decisions happen. When a packet arrives at the Transit Gateway from one attachment, the Transit Gateway checks the route table to decide which attachment to send it to.
Example Route Table:
| Destination CIDR | Attachment ID | Meaning |
|---|---|---|
| 10.1.0.0/16 | tgw-attach-vpc-a | Traffic for 10.1.x.x goes to VPC-A |
| 10.2.0.0/16 | tgw-attach-vpc-b | Traffic for 10.2.x.x goes to VPC-B |
| 192.168.0.0/16 | tgw-attach-vpn | Traffic for 192.168.x.x goes to On-Premises |
When a packet arrives:
Think of a route table like a directory at a mall.
When you want to find the Apple Store, you look at the directory. It says "Apple Store → 2nd Floor, West Wing." The directory (route table) tells you where to go based on what you're looking for (destination IP).
When you create a Transit Gateway, AWS can automatically create a default route table. All new attachments are automatically associated with this table unless you specify otherwise.
This is convenient for simple setups where all networks can talk to all other networks.
You can create multiple route tables for network segmentation. For example:
📖 Coming Up: We'll cover routing in depth in Topic 6: Route Tables & Routing - including associations, propagations, and static routes.
Multiple Route Tables = Network Segmentation
By using different route tables, you can control which networks can communicate. Route tables control reachability (network paths), not security enforcement.
Important: Actual security is enforced by Security Groups, NACLs, and firewall appliances. Route tables just determine if a path exists between networks.
This is the trickiest part of Transit Gateway, but once you understand it, everything clicks. Let's use a simple example.
Important to Know: Associations and Propagations are settings you configure when you create or manage attachments and route tables.
When you attach a VPC to Transit Gateway, AWS Console will ask you:
These are checkboxes/dropdowns you select during setup - they're not automatic!
🏢 Simple Example
You have:
You want VPC-A and VPC-B to talk to each other.
What you do:
What this means:
Think of association like choosing which GPS app to use.
When you leave your house (VPC-A) and want directions, which GPS do you open? Google Maps, Waze, or Apple Maps?
Association says: "When I send traffic out, use THIS route table (GPS app) to find where to go."
What you do:
What this does automatically:
10.1.0.0/16 → VPC-A attachment10.2.0.0/16 → VPC-B attachmentWhat this means:
Think of propagation like adding your address to a directory.
When you move to a new apartment (VPC-A at 10.1.0.0/16), you add your address to the building directory. Now anyone who checks the directory can find you.
Propagation says: "Add my network address to the route table so others can reach me."
Propagation is Optional!
You can choose NOT to enable propagation and instead manually add routes to the Transit Gateway route table.
Why you might do this:
Trade-off: Manual routes = more control but more work. Propagation = automatic but less control.
Let's see what happens when VPC-A wants to send traffic to VPC-B (10.2.5.5):
The Simple Rule:
• Associate an attachment = Outbound (which route table to use when SENDING)
• Propagate an attachment = Inbound (add routes so others can RECEIVE)
For two-way communication, you need BOTH!
| Association | Propagation |
|---|---|
| "Which route table do I use when I send traffic?" | "Add my routes to this table so others can find me" |
| Which route table TGW consults for traffic arriving from this attachment | Which route tables contain routes pointing to this attachment |
| Each attachment associates with ONE route table | Each attachment can propagate to MULTIPLE route tables |
| Manual: You choose which table | Automatic: Routes are added for you |
| Example: "VPC-A uses Route Table 1" | Example: "Add 10.1.0.0/16 → VPC-A to Route Table 1" |
📖 Coming Up: We'll see real examples of associations and propagations in Topic 6: Route Tables & Routing with multiple route tables for network segmentation.
Let's see how all 4 components work together with a simple example:
Scenario: You have 2 VPCs and want them to communicate.
Result: VPC-A and VPC-B can now communicate through the Transit Gateway!