AWS Transit Gateway and PrivateLink: Connect VPCs and Services Explained
Two VPCs peer easily; twenty VPCs become a mesh nightmare. Partners want private access to your service without the public internet. AWS Transit Gateway (TGW) is the hub for many VPCs; PrivateLink (interface endpoints / endpoint services) keeps traffic on the AWS network privately.
What you'll learn in this chapter
- Why hub-and-spoke beats full mesh peering
- What Transit Gateway and PrivateLink are
- How to connect VPCs and expose services privately
- Hybrid and industry patterns
- Lab, errors, FAQ, interview
1. Everyday example first
A Bengaluru bank has VPC-app, VPC-data, VPC-shared. Instead of peering every pair, each attaches to a Transit Gateway. A fintech partner reaches the bank’s payments API through a PrivateLink endpoint service — no public ALB required for that partner path.
2. Why TGW and PrivateLink?
Why do we need this?
VPC peering does not transit; meshes do not scale. TGW routes between attachments. PrivateLink exposes a Network Load Balancer-powered service to consumers via interface endpoints — private IPs in their VPC.
- Scale many VPC connections centrally
- Shared services VPC without spaghetti peering
- Private partner connectivity
- Hybrid via VPN/DX attachments to TGW
3. What are they?
What is it?
Transit Gateway: a regional hub. Attach VPCs, VPNs, Direct Connect gateways; use route tables to isolate or share. PrivateLink: create a VPC endpoint service (NLB) or consume AWS/partner services via interface VPC endpoints (ENIs in your subnets).
| Piece | Plain job |
|---|---|
| TGW | Hub router for many attachments |
| VPC attachment | Connect a VPC to TGW |
| TGW route table | Control which attachments talk |
| Interface endpoint | ENIs to reach a PrivateLink service |
| Endpoint service | Your NLB-backed private service |
| Gateway endpoint | S3/DynamoDB prefix-list style (not PrivateLink ENI) |
4. How to design without spaghetti
How to do it (step by step)
- Draw hub-and-spoke: shared, prod, nonprod spokes.
- Create TGW; attach VPCs; update subnet route tables to TGW.
- Use separate TGW route tables to isolate prod/nonprod if needed.
- For AWS APIs privately, prefer interface endpoints (or gateway for S3/DDB).
- To expose your SaaS privately, put NLB + endpoint service; accept consumer principals.
- Approve endpoint connections; least-privilege security groups on ENIs.
- For hybrid, attach VPN/DX to TGW; watch ASN/routes.
- Monitor TGW bytes and endpoint ENI costs.
- Document CIDR plan — overlapping CIDRs break designs.
- Avoid peering + TGW loops; pick a clear primary path.
# Mental model
# Consumer creates interface endpoint to vpce-svc-xxxxx
# ENIs get private IPs; SG allows app→ENI
# Provider NLB targets private IP tasks/instances5. TGW vs peering vs PrivateLink
| Option | When |
|---|---|
| VPC peering | Few VPCs, simple, no transit |
| Transit Gateway | Many VPCs / hybrid hub |
| PrivateLink | Expose/consume service privately across accounts |
| Public API + WAF | Internet clients; different threat model |
6. Multi-industry notes
ISVs sell PrivateLink-connected APIs to banks who forbid public egress. Manufacturers attach plant VPCs to a TGW shared-services hub for Active Directory. Unis use TGW to connect campus firewalls via DX.
7. Industries and roles
- Banks: private fintech connectivity
- ISVs: PrivateLink product SKU
- Enterprises: shared services hub
- Hybrid IT: DX + TGW
- Security: reduce public exposure
8. Lab: two VPCs + TGW path (account permitting)
Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.
How to do it (step by step)
- Create two small VPCs with non-overlapping CIDRs.
- Create TGW; attach both; fix routes for a ping path.
- Launch tiny instances; security groups allow ICMP/SSH via SSM preferably.
- Ping across VPCs via TGW; capture a traceroute mindset.
- Optional: create an interface endpoint to a public AWS service (e.g., SSM) in one VPC.
Cleanup (stop billing)
- Delete instances, attachments, TGW, VPCs.
- Watch for leftover ENIs/endpoints.
9. Common errors and fixes
Each row is a real mistake students and juniors hit. Read the fix before you panic.
| Error / symptom | Fix |
|---|---|
| Overlapping CIDRs across spokes | Re-IP or use careful NAT patterns; prefer unique CIDRs. |
| Peering mesh “temporary” forever | Migrate to TGW when > few VPCs. |
| TGW route table shares prod↔dev | Isolate route tables. |
| Open SG on endpoint ENIs | Least ports from app SG only. |
| Forgot consumer approval on endpoint service | Automate accept for trusted principals. |
| Used gateway endpoint expecting PrivateLink ENI | Know gateway vs interface. |
| No DX/VPN redundancy | Two tunnels/connections. |
| Cost surprise on many AZs endpoints | Endpoints are per-AZ ENIs. |
| Hairpin traffic inefficiently | Place endpoints near consumers. |
| DNS not enabling private DNS on endpoint | Turn on private DNS names when appropriate. |
10. Troubleshooting checklist
- No route: subnet RT missing TGW target.
- Blackhole: wrong TGW association/propagation.
- Endpoint pending: provider must accept.
- Timeouts: NLB targets unhealthy.
- DNS resolves public still: private DNS flag / hosted zone.
- Hybrid asymmetric routing: check return paths.
11. FAQ
Q. TGW free?
Hourly + data processing charges — check pricing.
Q. PrivateLink vs peering?
Service exposure vs network join.
Q. Cross-region TGW?
Peering TGWs across regions is a pattern.
Q. Replace Direct Connect?
No — DX is physical; TGW can attach it.
Q. Security?
SG/NACL + route isolation + endpoint policies.
Q. S3 via PrivateLink?
Gateway endpoint common; interface options exist for some.
12. Interview Q&A
Q. What is Transit Gateway?
Regional hub to connect VPCs/VPN/DX with route tables.
Q. Why not only peering?
No transit; mesh does not scale.
Q. PrivateLink?
Private connectivity to services via ENIs / endpoint services.
Q. Endpoint service needs?
NLB + allowed principals + connection acceptance.
Q. Hub-and-spoke benefit?
Central control, fewer connections.
Q. Overlapping CIDR problem?
Routing ambiguity; redesign CIDRs.
13. Tips in English, Marathi and Hindi
Ravindra Bagale's Tip (EN)
Draw CIDRs and trust boundaries before you click Create Transit Gateway. Networks are harder to renumber than IAM roles.
Ravindra Bagale's Tip (MR)
TGW create आधी CIDR व trust boundaries काढा. Renumber कठीण.
Tip (HI)
TGW बनाने से पहले CIDR और trust boundary बनाओ — IP बदलना IAM से कठिन है।
Try at home
- Sketch 3 spokes + shared hub with TGW route tables.
- List steps to expose an NLB service via PrivateLink.
- Write one overlapping CIDR failure story in two lines.
In short
- TGW hubs many VPCs/hybrid links.
- PrivateLink privately exposes/consumes services.
- Unique CIDRs and route isolation matter.
- Watch endpoint and TGW data costs.
Revision, interview and comparison cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.
Practice Tasks
Milan Furniture is a furniture business in Milan. Giulia Rossi looks after its IT and cloud work. They count money in EUR and run their AWS resources in the eu-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 16
Easy Describe transit gateways
Why: Hub inventory.
What to do: Describe transit gateways.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Describe VPC endpoints
Why: PrivateLink list.
What to do: Describe vpc endpoints.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy TGW beats many peerings — 1
Why: Scale.
What to do: Enter 1 if TGW scales better than many VPC peerings.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy PrivateLink no public internet — 1
Why: Private.
What to do: Enter 1 if Interface endpoints avoid public internet.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Describe TGW attachments
Why: VPC links.
What to do: Describe transit gateway attachments.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Describe TGW route tables
Why: Segregation.
What to do: Describe transit gateway route tables.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Describe VPC endpoint services
Why: Provider side.
What to do: Describe vpc endpoint services.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Describe TGW peering attachments
Why: Inter-region.
What to do: Describe transit gateway peering attachments.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Allow CreateVpcEndpoint
Why: Consumer LP.
What to do: Allow ec2:CreateVpcEndpoint on *.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Hub spoke JSON
Why: Prefer TGW hub.
What to do: JSON prefer_transit_gateway true.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.
Medium Separate route tables segment — 1
Why: Isolation.
What to do: Enter 1 if separate TGW route tables help segmentation.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Sample AZ count for HA endpoints
Why: HA.
What to do: Sample AZ count for HA interface endpoints (enter 2)?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Hard Describe TGW VPC attachments
Why: Per-VPC.
What to do: Describe transit gateway vpc attachments.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Describe VPC endpoint connections
Why: Accept/reject.
What to do: Describe vpc endpoint connections.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Allow DescribeTransitGateways
Why: Viewer LP.
What to do: Allow ec2:DescribeTransitGateways on *.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Private DNS JSON
Why: Keep private.
What to do: JSON PrivateDnsEnabled true.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.