VPC Peering vs Transit Gateway

Overview

What is being compared

Both connect VPCs privately on AWS. VPC Peering creates a direct routing connection between two VPCs. Transit Gateway is a regional hub that connects many VPCs, VPNs and Direct Connect links through a central router.

• Topology — Point-to-point, one link per pair — Hub and spoke
• Transitive routing — No, A to B and B to C does not give A to C — Yes, every attachment can route through the hub
• Links for 10 VPCs, full mesh — 45 peering connections — 10 attachments
• Cost — No hourly charge, data transfer only — $0.05 per attachment-hour plus $0.02 per GB processed
• On-premises access — Per VPC — One VPN or Direct Connect shared by all
• Overlapping CIDRs — Not allowed — Not allowed
• Best at — A few VPCs, lowest cost — More than 5 to 10 VPCs

> [!NOTE] A full mesh needs n(n-1)/2 peering connections, so the count grows much faster than the number of VPCs.

Moving from peering to Transit Gateway

Teams that outgrow a mesh can move to a hub without downtime, in this order. The main risk is a routing black hole if the route updates are applied in the wrong order across the VPCs.

Blue phases build the hub beside the peerings, yellow ones move and check traffic, and green removes the old links.

> [!TIP] The mesh and the hub side by side, a packet that peering drops but the Transit Gateway routes, and the choice between them, step by step in Visual Explanation below.

More Comparisons topics

• Route 53 Routing Policies
• S3 vs EFS vs EBS
• Spinnaker vs Argo CD
• SQL vs NoSQL
• SQS vs EventBridge
• SQS vs SNS