What is the difference between VPC peering and AWS Transit Gateway?
VPC peering is a one-to-one private link between two VPCs and it is not transitive. Transit Gateway is a central hub that connects many VPCs and on-premises networks, so each network connects once.
Explain it simply
Peering is a private road built directly between two colleges. Connecting ten colleges this way needs a road between every pair. A transit gateway is a central roundabout: each college builds just one road to the roundabout and can reach all others through it.
Example
VPC peering
A <-> B and B <-> C does NOT let A reach C
Needs routes on both sides, no overlapping CIDRs
N VPCs fully connected = N x (N-1) / 2 links
4 VPCs -> 6 peerings, 10 VPCs -> 45 peerings
No hourly charge for the connection itself, data transfer applies
Transit Gateway
Each VPC / VPN / Direct Connect attaches once
Routing controlled by route tables on the gateway
10 VPCs -> 10 attachments
Charged per attachment per hour and per GBUse peering for two or three VPCs that need simple, cheap connectivity. Use Transit Gateway when networks multiply, when you need to attach on-premises networks too, or when you want central routing control.
Neither works if the VPC CIDR blocks overlap.
What to say in the interview
"Peering is a direct, non-transitive link that needs non-overlapping CIDRs and gets messy beyond a few VPCs. Transit Gateway is a hub-and-spoke router that scales to many VPCs and on-premises links, at an extra cost per attachment and per GB."
Common mistakes
- Assuming peering lets traffic hop through a middle VPC.