VPC Peering & Transit Gateway

A VPC peering connection links exactly two VPCs and uses AWS internal networking, so there is no bandwidth bottleneck or single point of failure and no per-hour charge for the connection itself. The constraints matter for the exam. Peering is non-transitive: if VPC A peers with B and B peers with C, A still cannot reach C through B. The CIDR (Classless Inter-Domain Routing) blocks of peered VPCs cannot overlap. Edge-to-edge routing is blocked, so you cannot use a peer to reach the other side internet gateway, NAT gateway, VPN, or Direct Connect. Because each pair needs its own connection, a full mesh of N VPCs requires N times (N minus 1) divided by 2 connections, which becomes unmanageable quickly.

Transit Gateway is a regional, highly available router that VPCs and on-premises connections attach to. Each VPC, VPN, or Direct Connect gateway connects once to the TGW (an attachment), and the TGW forwards traffic between them. This is transitive: any attachment can reach any other attachment that routing allows, so connecting N VPCs needs N attachments instead of a quadratic mesh. A single TGW supports thousands of attachments (the default limit is 5,000 per Transit Gateway), which makes it the standard pattern for large multi-VPC and hybrid networks. Each VPC attachment supports up to 100 Gbps of bandwidth per Availability Zone in each direction.

A Transit Gateway route table controls which attachments can send traffic to which destinations, giving you network segmentation inside one TGW. Each attachment is associated with one route table (which routes that attachment uses for outbound decisions) and can propagate its VPC CIDRs into one or more route tables (which destinations other attachments learn). By associating production and development attachments with separate route tables and propagating selectively, you can let both reach shared services while keeping them isolated from each other, without spinning up extra Transit Gateways.

Choose VPC peering when you connect a small, fixed number of VPCs that mostly need point-to-point paths, want the lowest cost (no hourly hub charge), and do not need transitive routing. Choose Transit Gateway when the number of VPCs grows, when you need transitive any-to-any routing, when you also connect VPN or Direct Connect, or when you need a central point to enforce segmentation and inspection. Transit Gateway adds a per-attachment hourly charge plus per-GB data processing, so peering can be cheaper for just a few VPCs.

Inter-Region VPC peering connects VPCs in different AWS Regions over the encrypted AWS global backbone, so cross-Region traffic stays off the public internet. The same rules apply: it is non-transitive, CIDRs cannot overlap, and some features (such as referencing a peer security group) are limited compared to same-Region peering. Transit Gateway is regional, so to span Regions you create a Transit Gateway peering attachment between a TGW in each Region. This connects two hubs and keeps the design scalable, while inter-Region VPC peering remains a simpler choice for a single cross-Region VPC pair.