AWS Transit Gateway and Network Architecture

AWS Cloud & DevOps Engineering · Lesson 52 · Advanced Platforms and Networking

Lesson Overview

When TechLearningPro’s account count rises, VPC peering meshes become an operations tax: non-transitive routes, exponential connection counts, and no central place to enforce segmentation. AWS Transit Gateway (TGW) is a regional hub that attaches VPCs, VPN connections, Direct Connect gateways (via transit VIFs), and peering to other TGWs, with route tables that control which attachments can reach which prefixes. This lesson teaches hub-and-spoke design, attachment lifecycle, route propagation vs static association, segmentation (prod vs stage vs sandbox vs on-prem), and an inspection VPC tease (centralized firewall / Network Firewall patterns) so east-west and north-south traffic can be steered for security—without inventing undocumented TGW features or quoting fake per-GB rates.

Builds on Cross-Account Access and Multi-Account Networking, PrivateLink, and Hybrid Connectivity. Landing zone Network Hub from Organizations & Control Tower. Tag Project=tlp-lesson52. TGW attachments and data processing bill—budgets on; delete lab TGWs/attachments after exercises.

Learning Objectives

1. Explain why TGW replaces large peering meshes.
2. Describe TGW attachments: VPC, VPN, DX Gateway, peering, Connect (awareness).
3. Design hub-and-spoke for TechLearningPro Network Hub account.
4. Separate TGW route tables for prod, nonprod, shared, and inspection.
5. Contrast route propagation with explicit associations and static routes.
6. Share TGW via RAM to member accounts (continuity with lesson 49).
7. Segment sandbox so it cannot route to prod or on-prem.
8. Tease inspection VPC / appliance mode patterns for centralized firewalling.
9. Reason about blackhole routes and default route steering to inspection.
10. Plan multi-AZ VPC attachments (subnets in multiple AZs).
11. Estimate qualitative cost drivers; verify current TGW pricing pages.
12. Troubleshoot missing routes vs SG denies vs DNS issues.
13. Compare when PrivateLink alone is enough versus TGW CIDR routing.
14. Document network change control and route table ownership.
15. Prepare interview answers with segmentation examples.
16. Avoid transitive surprise from over-propagated routes.
17. Integrate hybrid attachments without flattening trust.
18. Clean up lab TGW resources; keep budgets on.

Prerequisites

• Lessons 48–51 networking spine; IAM/RAM awareness.
• Ability to create networking resources in a sandbox or deliver design-only packs.
• Budget alerts before TGW creation.

Detailed Core Concepts

Transit Gateway as a hub

Think of TGW as a cloud router you do not SSH into: attachments are like ports; route tables decide forwarding. VPCs no longer peer pairwise; each attaches once (per TGW/Region).

Attachments

• VPC attachment — choose subnets (ENIs) per AZ; routes point 0.0.0.0/0 or specific prefixes to tgw-id as needed.
• VPN attachment — hybrid tunnels terminate on TGW.
• Direct Connect Gateway association with transit VIF patterns.
• TGW peering — connect TGWs across Regions (latency/cost awareness).
• Others (e.g., Connect appliances)—verify current attachment types in docs.

Route tables and segmentation

Multiple TGW route tables enable isolation domains. Example TechLearningPro:

• rtb-prod — prod spokes + shared services + inspected on-prem.
• rtb-nonprod — stage/dev spokes + shared (maybe) without prod.
• rtb-sandbox — internet egress only / no on-prem / no prod.
• rtb-inspect — inspection VPC attachment.

Associations bind an attachment to one route table for outbound from that attachment; propagations/static routes control what destinations appear.

Propagation vs static

Propagation automatically learns attachment CIDRs into a route table when enabled. Convenient and dangerous: propagating sandbox into prod tables creates the mesh you fled. Prefer explicit propagations and static routes for sensitive paths; document every propagation.

Inspection VPC tease

Insert a VPC with AWS Network Firewall or third-party appliances; use TGW route tables so spoke→spoke or spoke→egress traffic next-hops via inspection attachments (appliance mode / appliance VPC patterns—confirm current recommended architectures in AWS docs). This lesson requires you to explain why inspection exists and sketch route steering—not to invent firewall rule APIs.

PrivateLink coexistence

Shared Auth via PrivateLink (lesson 50) may not need TGW routes between app CIDRs. Use TGW for systems that need broad subnet reachability (directory services, legacy middle tiers); use PrivateLink for tightly scoped APIs.

Architecture and Design Diagrams

mermaidCopy
flowchart TB
  TGW[Transit Gateway Network Hub]
  ProdRT[TGW route table prod]
  NonprodRT[TGW route table nonprod]
  SandRT[TGW route table sandbox]
  Insp[Inspection VPC]
  ProdVPC[Prod app VPC]
  StageVPC[Stage VPC]
  SandVPC[Sandbox VPC]
  Shared[Shared services VPC]
  Hybrid[VPN / DX attachment]

  ProdVPC --- ProdRT
  Shared --- ProdRT
  Insp --- ProdRT
  Hybrid --- ProdRT
  StageVPC --- NonprodRT
  Shared --- NonprodRT
  SandVPC --- SandRT
  TGW --- ProdRT
  TGW --- NonprodRT
  TGW --- SandRT

mermaidCopy
flowchart LR
  Src[Spoke packet]
  Assoc[Attachment association RT]
  Lookup[TGW route lookup]
  Dest[Destination attachment]
  Src --> Assoc --> Lookup --> Dest

Technical Explanation

Packet path mental model

Instance in spoke → VPC route to TGW → TGW uses the route table associated with that VPC attachment → selects destination attachment → arrives in destination VPC subnet routing/SGs. If inspection is in path, next hop may be inspection attachment first.

Multi-AZ attachments

Create VPC attachments with subnets in each AZ used by workloads for resilience. Undersized or single-AZ attachments become silent availability risks.

RAM sharing

Network Hub owns TGW; shares with OUs via RAM; members create VPC attachments to the shared TGW (per current sharing model—verify docs). Centralizes cost and change control.

Route limits and scale

TGW has quotas on routes, attachments, and bandwidth characteristics—check current quotas. Summarize aggressively; do not explode more-specific routes without need.

Blackholes and safety

Static blackhole routes can reserve space or block ranges. During incident response, withdrawing propagations can isolate accounts quickly—practice in nonprod.

Performance

Each TGW hop adds latency; inspection adds more. Chatty microservices across many TGW hops may need redesign (collapse cells, PrivateLink, or colocated tiers). Measure before debating folklore.

Security

TGW is not a firewall. Segmentation route tables reduce reachability; SGs/NACLs/firewall still enforce. Combine with SCPs that prevent rogue peering that bypasses the hub.

Cost

Attachments and data processing are billable dimensions—verify TGW pricing. Idle attachments in every sandbox hurt. Central egress NAT in inspection/egress VPC can concentrate NAT cost—FinOps lesson 47 continuity.

Operations

Own route tables like firewall rulesets: PR review, change tickets, automated drift detection where possible. Export route table inventories weekly.

Practical Implementation or Design Walkthrough

Problem

Build a segmented Transit Gateway routing design for TechLearningPro hub-and-spoke with sandbox isolation and inspection tease.

Steps

1. Budget; tag Project=tlp-lesson52.
2. Draw attachments and four route tables (prod/nonprod/sandbox/inspect).
3. Write association/propagation matrix (spreadsheet).
4. Explicitly deny sandbox→prod and sandbox→on-prem in the matrix.
5. Sketch inspection steering for prod east-west (conceptual).
6. Decide which shared services use PrivateLink instead of TGW.
7. If lab: create TGW, two VPC attachments, prove ping/HTTP, then isolate via route table change; destroy.
8. ADR: TGW + segmentation + inspection roadmap.
9. Cleanup attachments/TGW; budgets on.

Enterprise Real-World Scenarios

Propagation accident

Junior engineer enabled propagation of all attachments into one table. Sandbox scanned stage Redis. Fix: separate tables; code review for TGW changes; revert.

Peering leftover bypass

Old peering left between accounts bypassed inspection. Inventory and delete legacy peers; SCP intent to deny new peering in prod OUs (verify actions).

Inspection asymmetric path

Return traffic bypassed firewall; sessions broke. Redesign route symmetry per AWS inspection guidance.

Cross-Region chatty apps

TGW peering used for sync chat; latency hurt. Move to regional stacks with async replication.

FinOps spike

Hundreds of sandbox attachments. TTL policy + shared sandbox VPC pattern for students.

Best Practices

1. One Network Hub owns TGW.
2. Multiple route tables for segmentation.
3. Explicit propagation matrices.
4. Multi-AZ VPC attachments.
5. Prefer PrivateLink for single APIs.
6. Change-control route tables.
7. Quarterly route audits.
8. Alarm attachment state failures.
9. Plan inspection early if required by Security.
10. Summarize routes.
11. RAM share to OUs carefully.
12. Eliminate bypass peerings.
13. Tag attachments with Environment.
14. Verify quotas and pricing live.
15. Destroy lab TGWs promptly.

Common Mistakes and Anti-Patterns

1. Single shared route table for all attachments.
2. Propagate everything “to make it work.”
3. Single-AZ attachments.
4. Treating TGW as a firewall alone.
5. Leaving peering meshes alongside TGW.
6. Sandbox attached with prod routes.
7. No ownership of Network Hub.
8. Invented TGW API flags in writeups.
9. Ignoring data processing costs.
10. Skipping return-path design for inspection.

Troubleshooting and Design Review

Interview Questions and Answers

Q1: Why TGW? A: Scalable hub routing vs non-transitive peering meshes.
Q2: Association vs propagation? A: Association selects which RT an attachment uses to send; propagation/static populate destinations.
Q3: Segmentation? A: Separate TGW route tables / domains for prod, nonprod, sandbox.
Q4: Inspection VPC? A: Centralize firewalling by steering routes through an appliance VPC.
Q5: RAM role? A: Share TGW to accounts/OUs for attachments.
Q6: PrivateLink vs TGW? A: Service-specific private exposure vs CIDR routing hub.
Q7: Hybrid? A: VPN/DX attachments into TGW with careful RT placement.
Q8: Multi-AZ? A: Attach using subnets across AZs.
Q9: Common outage cause? A: Route table mischange.
Q10: Cost drivers? A: Attachments + data processing—verify pricing.
Q11: Blackhole use? A: Block or reserve prefixes deliberately.
Q12: Cross-Region? A: TGW peering with latency/cost awareness.
Q13: Security residual? A: Still need SG/firewall/IAM.
Q14: Landing zone fit? A: Network Hub account under Infrastructure OU.
Q15: First isolation step in incident? A: Withdraw propagations / isolate RT.

Hands-On Exercises

Exercise: Build a segmented Transit Gateway routing design

Deliverable: diagrams, association/propagation matrix, inspection tease, PrivateLink coexistence list, ADR, lab proof or design sign-off, cleanup, budget.

Challenge ADR

Constraint: PCI-like segment for payment-adjacent prod must traverse inspection; sandbox must never. Encode in RT matrix + change control.

Lab evidence checklist

Matrix; diagrams; before/after connectivity test; destroy proof.

Narrative: the Friday propagation

“Enable all propagations” fixed a demo and opened prod to sandbox. Monday’s audit made TGW route PRs mandatory.

Continuity

Next: RDS, Aurora and DynamoDB Operations—data platforms sitting in these segmented VPCs.

Deep dive: appliance mode awareness

Confirm current TGW appliance mode / inspection behaviors in AWS docs before implementation ADRs.

Deep dive: egress VPC pattern

Central NAT/proxy egress via TGW for spokes lacking local NAT—FinOps and control trade-offs.

Deep dive: network firewall rule ownership

Security owns policies; platform owns TGW steering; app teams own SG allowances—RACI.

Extended enterprise scenario: acquisition VPC onboarding

New CIDRs attach as nonprod first; promote route tables after scan; no automatic prod propagation.

Extended enterprise scenario: exam-week isolation

Temporarily tighten sandbox RT to block shared research VPC; communicate in status page.

Extended practice scenario 1 — 52 aws transit gateway and network architecture

Create association/propagation matrix for prod/nonprod/sandbox/inspect.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 2 — 52 aws transit gateway and network architecture

Diagram hub-and-spoke with Network Hub ownership.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 3 — 52 aws transit gateway and network architecture

Lab or design: two VPCs via TGW; prove then isolate by RT change.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 4 — 52 aws transit gateway and network architecture

List bypass risks: peering, endpoints, public paths.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 5 — 52 aws transit gateway and network architecture

Inspection VPC tease with route steering narrative.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 6 — 52 aws transit gateway and network architecture

Decide Auth via PrivateLink vs TGW routes—ADR paragraph.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 7 — 52 aws transit gateway and network architecture

RAM share design from Hub to Workloads OU.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 8 — 52 aws transit gateway and network architecture

Quota check exercise using current TGW quota docs.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 9 — 52 aws transit gateway and network architecture

FinOps: estimate which attachments exist in sandboxes; cleanup plan.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 10 — 52 aws transit gateway and network architecture

Write PR template for TGW route changes.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 11 — 52 aws transit gateway and network architecture

Blackhole route use-case flashcard.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 12 — 52 aws transit gateway and network architecture

Hybrid attachment placement on prod RT only.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 13 — 52 aws transit gateway and network architecture

Multi-AZ attachment checklist.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 14 — 52 aws transit gateway and network architecture

Latency tabletop for chatty services across inspection.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 15 — 52 aws transit gateway and network architecture

Incident: isolate compromised spoke in 10 minutes—runbook.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 16 — 52 aws transit gateway and network architecture

Compare TGW peering cross-Region vs local stacks.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 17 — 52 aws transit gateway and network architecture

Tagging standard for attachments Environment/Owner.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 18 — 52 aws transit gateway and network architecture

SCP intent to discourage rogue peering—doc-cite actions.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 19 — 52 aws transit gateway and network architecture

Teach-back association vs propagation with a drawn example.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 20 — 52 aws transit gateway and network architecture

Peer-review a single-RT design; rewrite segmented.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 21 — 52 aws transit gateway and network architecture

Egress VPC pros/cons for TechLearningPro.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 22 — 52 aws transit gateway and network architecture

Export route inventory mock spreadsheet.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 23 — 52 aws transit gateway and network architecture

Budget pre-check before creating TGW.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 24 — 52 aws transit gateway and network architecture

Destroy lab TGW/attachments with evidence.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Extended practice scenario 25 — 52 aws transit gateway and network architecture

Dress rehearsal: matrix + lab/design + ADR + teach-back.

In a timed drill for Transit Gateway hub-and-spoke segmentation, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: RT matrices, diagrams, connectivity proofs, ADR, destroy confirmation, and destroy confirmation for any lab resources.

Discuss how this lesson connects to RAM/cross-account (49), PrivateLink (50), hybrid (51), landing zones (48), FinOps (47). List two failure modes you simulated or observed (over-propagation; inspection asymmetry), including detection and fix. Note which billable dimensions may move and when Cost Explorer would show them—verify current pricing pages; never invent rates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating multi-account networking and data platforms as mystery consoles.

Compliance evidence pack for auditors / Finance

Network architecture ADR; RT matrices; change tickets; inspection design; RAM share inventory; pricing verification; cleanup records.

Glossary drill

Transit Gateway; attachment; association; propagation; TGW route table; hub-and-spoke; inspection VPC; appliance mode (awareness); TGW peering; RAM share; blackhole route; Network Hub.

Budget and cleanup sworn statement

I verified budgets remain enabled. I deleted lab TGW/attachments named ____. I invented no prices or APIs. Signed ________ date ________.

Interview story to memorize

“TechLearningPro runs a Network Hub Transit Gateway with separate route tables for prod, nonprod, and sandbox, shares the TGW via RAM, steers sensitive traffic toward an inspection VPC, and uses PrivateLink instead of CIDR sprawl for shared Auth—every route change peer-reviewed.”

Self-assessment rubric

Final synthesis before summary

TGW multiplies your intent: good matrices create isolation; lazy propagations recreate the mesh with better billing line items. Write the matrix first.

Lesson Summary

Transit Gateway enables scalable hub-and-spoke networking with route-table segmentation across VPC, VPN, and DX attachments. Design TechLearningPro’s Network Hub with explicit association/propagation matrices, sandbox isolation, inspection steering where required, and PrivateLink coexistence. Tag Project=tlp-lesson52; verify pricing; clean up lab TGWs.

Next: RDS, Aurora and DynamoDB Operations.

Further Reading

• What is a transit gateway?
• Transit gateway route tables
• Share a transit gateway
• Centralized inspection architecture guidance
• AWS PrivateLink
• Transit Gateway pricing (verify current)
• AWS Pricing