AWS Transit Gateway Cheat Sheet

• A networking service that uses a hub and spoke model to enable customers to connect their on-premises data centers and their Amazon Virtual Private Clouds (VPCs) to a single gateway.
• With this service, customers only have to create and manage a single connection from the central gateway into each on-premises data center, remote office, or VPC across your network.
• If a new VPC is created, you simply attach it to the Transit Gateway, making it available to every other connected network (subject to route table rules).

Features

Inter-region Peering

• Transit Gateway leverages the AWS global network to allow customers to route traffic across AWS Regions.

• Inter-region peering provides an easy and cost-effective way to replicate data for geographic redundancy or to share resources between AWS Regions.

• Transit Gateway also supports peering attachments within the same AWS Region, enabling scalable connectivity between multiple transit gateways.

Multicast

• Enables customers to have fine-grained control over who can consume and produce multicast traffic.

• Allows customers to create and manage multicast groups in the cloud without deploying or maintaining legacy multicast hardware on premises.

• This solution is scalable and supports simultaneous distribution of content streams to multiple subscribers.

Transit Gateway Connect (SD-WAN Integration)

• Provides a native way to connect SD-WAN (Software-Defined Wide Area Network) appliances and third-party virtual appliances running in a VPC to AWS.

• Uses GRE (Generic Routing Encapsulation) tunnels instead of IPsec VPNs, enabling higher bandwidth and improved performance.

• Removes the need to configure public IP addresses or manually manage IPsec VPN tunnels for SD-WAN appliances.

AWS Transit Gateway Network Manager

• Provides a unified dashboard to visualize and monitor global networks across AWS and on-premises environments.

• Includes Route Analyzer to analyze and debug routing paths between resources, helping identify connectivity issues such as unreachable VPCs or VPN connections.

• Automatically identifies Site-to-Site VPN connections and their associated on-premises resources.

Routing and Policy Control

• Supports transit gateway policy tables that enable dynamic routing and automatic exchange of routing and reachability information between connected and peered transit gateways.

• Allows prefix list references to be used in transit gateway route tables, simplifying route management at scale.

Enhanced Metrics and Flow Logs

• Supports CloudWatch metrics for individual transit gateway attachments, including availability zone–level visibility, enabling detailed monitoring and troubleshooting.

• Supports Transit Gateway Flow Logs, allowing network traffic between transit gateways and attached resources to be logged and analyzed.

Appliance Mode Enhancements

• Supports appliance mode on VPC attachments to ensure bidirectional traffic flows through the same Availability Zone.

• Improves routing predictability and performance for firewall, intrusion detection, and traffic inspection appliances.

Security and Encryption

• Supports encryption in transit, allowing organizations to enforce encrypted traffic across transit gateway attachments.

• Supports security group referencing across VPCs attached to a transit gateway, enabling simplified and centralized security policy management.

• Supports traffic mirroring on transit gateway attachments to send copies of network traffic to security appliances for inspection and threat monitoring.

Network Function Attachments

• Supports network function attachments that allow a transit gateway to connect directly to AWS Network Firewall.

• Enables simplified deployment of centralized traffic inspection architectures without complex routing configurations.

Cost Management and Quotas

• Supports flexible cost allocation policies to control how data processing and data transfer costs are allocated across an organization.

• Supports cost allocation tagging to help track and allocate transit gateway networking costs across teams and environments.

• Enforces bandwidth quotas to control and manage transit gateway throughput limits.

AWS Transit Gateway Pricing

• Attachment: You are charged an hourly rate for each attachment (VPC, VPN, or Connect attachment) associated with your Transit Gateway.

• Data Processing: You are charged per GB for data processed by the Transit Gateway.

• Data Transfer: Standard AWS data transfer charges apply for traffic leaving AWS.

Note: If you are studying for the AWS Certified Advanced Networking Specialty exam, we highly recommend that you take our AWS Certified Advanced Networking – Specialty Practice Exams and read our Advanced Networking Specialty exam study guide.

Validate Your Knowledge

Question 1

A multinational bank has two data centers that are 60 miles (96.56 kilometers) from each other. The bank also has a single transit gateway that has multiple VPC and VPN attachments.

The Network team recently established two AWS Direct Connect connections from the company’s on-premises data centers to a Direct Connect location with the help of a local Direct Connect Partner. Afterward, they provisioned an AWS Direct Connect Gateway that connects to the AWS Direct Connect location via a transit virtual interface.

With this setup, what other network connections can be implemented? (Select TWO.)

1. Connect multiple VPCs in the same or different AWS account using the Direct Connect connection.
2. Associate multiple transit gateways in different AWS Regions to the Direct Connect Gateway and use the same ASNs for each transit gateway. Enable the Appliance mode for all transit gateways.
3. Allow on-premises servers to connect to AWS resources that are reachable via public IP addresses such as AWS public endpoints and S3 buckets. Configure the Appliance mode on the existing transit gateway.

4. Use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections in different AWS Regions.
5. Associate multiple transit gateways in the same AWS Region.

For more AWS practice exam questions with detailed explanations, visit the Tutorials Dojo Portal:

AWS Transit Gateway Cheat Sheet Reference:
https://aws.amazon.com/transit-gateway/