Lecture 80: Transit Gateway AZ considerations
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:39
- 来源：Udemy Lecture 28587759
- Slide 数量：3
- 画面切换：00:40、02:17
扫描说明
逐条检查了 Udemy 页面中的 85 条 Transcript cue，并对全长约 3:39 的视频画面逐段扫描。视频由标题、VPC/TGW 子网设计架构图和 Availability Zone considerations 要点页三张独立 Slide 构成，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Transit Gateway 的 VPC 与子网设计目标
时间范围：00:00–00:40
总结 / Summary
中文
中转网关附件（Transit Gateway attachment）会在所选子网中创建弹性网络接口（Elastic Network Interface, ENI），因此附件不仅属于某个虚拟私有云（Virtual Private Cloud, VPC），也与该子网所在的可用区（Availability Zone, AZ）绑定。生产设计必须根据希望接入 TGW 的 AZ 来规划附件子网，而不能只沿用单子网实验拓扑。
English
A Transit Gateway attachment creates an Elastic Network Interface in the selected subnet, so the attachment is tied not only to a VPC but also to that subnet's Availability Zone. Production designs must plan attachment subnets for every AZ that needs TGW access rather than copying a single-subnet lab topology.
Transcript
00:00 Hello, and welcome to this lecture.
00:01 Now, so far for the transit gateway,
00:03 we had just a simple setup
00:05 where we had three VPCs
00:07 and then we just have one private subnet in every VPC.
00:11 And then we created the transit gateway attachment
00:14 using those subnets.
00:16 Now, what transit gateway does is
00:17 it also creates the ENR in that particular subnet.
00:21 And of course that means in a particular availability zone
00:25 in which that subnet resides.
00:27 However, there are certain peculiar things
00:29 about the transit gateway
00:31 and you need to design your VPCs
00:33 and the subnets accordingly.
00:35 So let's see how the design should look like
00:37 while using the transit gateway.
2. VPC Design：每个所需 AZ 配置 Connectivity Subnet
时间范围：00:40–02:17
总结 / Summary
中文
推荐把工作负载子网（workload subnets）与连接子网（connectivity subnets）分开，并在每个需要 TGW 连接的可用区（Availability Zone, AZ）提供一个专用私有子网（dedicated private subnet）。创建 VPC 附件（VPC attachment）时选择这些子网，TGW 会在其中放置弹性网络接口（Elastic Network Interface, ENI）。同一已启用 AZ 内的其他子网均可经该附件访问 TGW；未在附件中启用的 AZ 则不能直接使用它。专用子网也便于为集中式入侵检测与防御系统（Intrusion Detection and Prevention System, IDS/IPS）或集中式互联网出口配置清晰的路由。
English
A recommended VPC design separates workload subnets from connectivity subnets and provides one dedicated private subnet in every AZ that requires TGW connectivity. The VPC attachment uses those subnets and the TGW places an ENI in each one. Other subnets in an enabled AZ can reach the TGW through that attachment, whereas subnets in an AZ not enabled on the attachment cannot. Dedicated connectivity subnets also make routing for centralized IDS/IPS or centralized internet egress easier to manage.
Transcript
00:40 Okay. Now, if you see this architecture,
00:43 there are public subnets, there are private subnets,
00:45 and I also have a separate set of subnets
00:50 for connectivity to the transit gateway.
00:53 Now, this is an ideal setup
00:54 where you dedicate one private subnet
00:57 in each availability zone for the transit gateway.
01:01 And when I say in each availability zone,
01:04 it doesn't mean it's an ideal,
01:05 but this is how it should be
01:07 because transit gateway has a limitation
01:10 where if you create the transit gateway attachment
01:13 in a given AZ,
01:14 then only the subnet from that AZ
01:16 would be able to communicate with the transit gateway
01:20 through that attachment.
01:22 Now, this is not the something that we have seen earlier.
01:25 If you create, say ENI,
01:27 all the subnet in the VPC are typically able to communicate
01:31 via that ENI.
01:32 But this is not true for the transit gateway.
01:35 And that's where if you need connectivity
01:37 across three availability zones,
01:40 then you should have transit gateway attachment
01:43 created in three availability zone in your VPC.
01:48 And that's what is shown here, right?
01:51 And it is also good to have a dedicated subnet
01:54 for transit gateway attachments.
01:56 Sometimes you also have to, you know,
01:59 use the transit gateway for centralized IPS and IDS systems
02:04 or you want to have the outbound internet connectivity
02:06 through the transit gateway.
02:09 In that case, it makes sense to have a dedicated subnet
02:12 so that you can have the corresponding routes
02:14 attached to this private subnets.
3. Availability Zone Considerations
时间范围：02:17–03:39
总结 / Summary
中文
每个需要启用的可用区（Availability Zone, AZ）只能为一个 VPC 附件（VPC attachment）指定一个子网；通常可使用 /28 连接子网（connectivity subnet）以节省地址，因为 TGW 的弹性网络接口（Elastic Network Interface, ENI）只占用其中一个 IP。启用某 AZ 后，该 AZ 内所有子网都可以把流量路由到 TGW，而未启用 AZ 中的资源无法到达 TGW。由此，跨三个 AZ 的高可用设计应在三个 AZ 中分别选择附件子网，并为相关工作负载子网配置相应路由。
English
For each enabled Availability Zone, a VPC attachment selects exactly one subnet. A small /28 connectivity subnet is commonly sufficient because the TGW ENI consumes one address and the remaining workload addresses need not be wasted. Once an AZ is enabled, all subnets in that AZ may route to the TGW; resources in an AZ not enabled on the attachment cannot reach it. A highly available three-AZ design therefore selects one attachment subnet in each AZ and configures the relevant workload-subnet routes.
Transcript
02:17 Okay, so the Availability Zone considerations
02:19 for transit gateways.
02:20 So when you attach VPC to the transit gateway,
02:23 you must enable one or more AZs
02:26 to be used by transit gateway
02:28 so that the traffic can be routed
02:30 to the VPC subnet in those particular AZs.
02:33 So to enable each AZ,
02:35 you specify exactly one subnet,
02:37 typically in the range of /28,
02:40 because you don't want to waste unnecessarily
02:42 the IP addresses inside VPC.
02:45 /28 still gives 11 usable IP addresses.
02:49 Now transit gateway places
02:51 network interface in the subnet using one IP address
02:54 from the subnet, we know that.
02:56 But remember that after you enable the AZ,
02:59 traffic can be routed to all subnet in that AZ only.
03:03 So resources that reside in the same AZ,
03:06 where there is no transit gateway attachment
03:08 cannot reach to the transit gateway, right?
03:12 So that's one important consideration
03:14 when it comes to the transit gateway.
03:16 Remember, in whichever AZ you are creating
03:19 the transit gateway attachment,
03:21 only the subnets from that AZ
03:23 will be able to communicate to the transit gateway;
03:26 other subnets will not be.
03:28 So that's it for the consideration of the VPCs
03:31 and subnet for transit gateway.
03:33 And now we'll see some more architectures
03:36 for the transit gateway.
03:37 Thanks for watching.
整讲总结 / Overall Summary
中文
本讲说明中转网关（Transit Gateway, TGW）的 VPC 附件（VPC attachment）具有可用区（Availability Zone, AZ）维度：附件会在每个所选子网中创建弹性网络接口（Elastic Network Interface, ENI），只有被附件启用的 AZ 才能使用该 TGW 连接。推荐为每个所需 AZ 建立独立的 /28 连接子网（connectivity subnet），将其与工作负载子网（workload subnets）分离；同一已启用 AZ 内的所有子网可共用该附件 ENI。若希望三个 AZ 都具备连接和高可用性，就必须在三个 AZ 中各选择一个附件子网，并配套正确的 VPC 路由。
English
This lecture explains the Availability Zone dimension of a Transit Gateway VPC attachment. The attachment creates a TGW ENI in each selected subnet, and only AZs enabled on the attachment can use that TGW connection. A recommended design creates a dedicated /28 connectivity subnet in every required AZ and separates those subnets from workload subnets; all subnets in the same enabled AZ can share the attachment ENI. To provide connectivity and resilience across three AZs, select one attachment subnet in each AZ and configure the corresponding VPC routes.
返回顶部 ↑