SYSTEM Cited by 4 sources

AWS Transit Gateway¶

What it is¶

AWS Transit Gateway is AWS's regional network transit hub — a hub-and-spoke router that interconnects multiple VPCs, VPN connections, and Direct Connect gateways within an AWS Region.

Partition scope¶

A central cross-partition architectural fact: "AWS Transit Gateway inter-region peering cannot function across partitions" (Source: sources/2026-01-30-aws-sovereign-failover-design-digital-sovereignty). Each partition's Transit Gateway is independent.

Consequence: cross-partition networking has to use one of the three named mechanisms (internet-TLS, IPsec VPN, Direct Connect) — not TGW peering.

Role in sovereign-failover topology¶

"Networking requires isolated Transit Gateways, separate Amazon Route 53 DNS zones, and secure cross-partition communication using AWS PrivateLink."

Hub for centralised Network-Firewall inspection¶

The second major TGW shape on the wiki — beyond cross-region / cross-partition hub — is ** centralised network inspection** for many VPCs + on-prem behind a single AWS Network Firewall. Canonical wiki reference: the 2025-11-26 Amazon EVS post.

Mechanism: native TGW ↔ Network Firewall integration (GA July 2025) creates a firewall TGW attachment of resource-type Network Function with Appliance Mode automatically enabled. Traffic is forced through the firewall by the [[patterns/pre-inspection-post-inspection- route-tables|pre-inspection / post-inspection two-RT split]]:

Pre-inspection RT — all VPC + DXGW attachments associated; 0.0.0.0/0 → firewall attachment.
Post-inspection RT — only the firewall attachment associated; per-destination static routes back to each spoke.

With Default route-table association and Default route- table propagation explicitly deselected on the TGW, new attachments can't accidentally bypass the inspection path.

This shape inspects east-west (VPC↔VPC, VM↔VPC), north-south (VPC↔on-prem via DXGW, VPC↔internet via dedicated egress VPC), and on-prem↔internet through a single firewall with one policy.

A cross-account Transit Gateway is commonly shared via AWS RAM. When the consuming account's organization- bound share is removed (e.g. the account leaves its AWS Organization), the TGW exhibits the textbook control-plane / data-plane split: existing attachments and traffic keep flowing (data plane intact), but the account can no longer modify the shared TGW (control plane lost). In the canonical migration this surfaced as a terraform apply failure (ec2:TransitGateway permission error) while traffic kept flowing and no alarm fired. This is the archetypal example of why the failure stayed hidden. (Source: sources/2026-08-24-aws-preserving-ram-shares-and-lake-formation-permissions-during-organizations-migration)

Stub page¶

Seen in¶

sources/2026-09-17-aws-how-equinix-cut-operational-overhead-with-a-shared-services — TGW as the connectivity hub in a dedicated Network account for Equinix's shared-services EKS platform: a two-Region hub (us-west-1 + us-east-2) with inter-Region peering, TGW attachments connecting the Workloads and Platform VPCs to the central hub for controlled cross-account communication, paired with Route 53 Resolver + private hosted zone and Direct Connect (dual circuits) to on-prem. The "hub in its own account" shape that keeps networking as a governed, separate concern from workloads and shared services.
sources/2026-08-24-aws-preserving-ram-shares-and-lake-formation-permissions-during-organizations-migration — a shared TGW is the headline example of RAM control-plane loss on account move: terraform apply failed with ec2:TransitGateway permission error while traffic kept flowing and no alarm fired.
sources/2025-11-26-aws-secure-amazon-evs-with-aws-network-firewall — canonical wiki reference for the centralised Network- Firewall inspection shape: native TGW attachment of resource-type Network Function with auto-enabled Appliance Mode, two-RT split (pre/post-inspection), inspecting EVS + Workload + Ingress + Egress VPCs + Direct Connect Gateway through one firewall.
sources/2026-01-30-aws-sovereign-failover-design-digital-sovereignty — Transit Gateway inter-region peering named as a primitive that does not function across partitions; isolated TGWs per partition prescribed in the sovereign-failover topology.

systems/aws-direct-connect, systems/aws-privatelink
systems/aws-network-firewall — canonical inspection engine behind a TGW attachment.
aws-partition
centralized-network-inspection — the hub-and-spoke inspection architectural class.
tgw-appliance-mode — attachment property auto-enabled by the native Network-Firewall integration.
bump-in-the-wire-middlebox — the insertion mechanism behind the TGW inspection path.
cross-partition-failover
pre-inspection-post-inspection-route-tables — the TGW routing pattern for centralised inspection.