Lecture 92: Transit Gateway vs VPC Peering
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:13
- 来源：Udemy Lecture 28655222
- Slide 数量：4
- 画面切换：00:16、02:40、02:59
扫描说明
逐条检查了 Udemy 页面中的 85 条 Transcript cue，并对全长约 6:13 的视频画面逐段扫描。依据标题页、VPC Peering/TGW 前半对比表、Security Group Referencing 控制台演示，以及完整对比与成本结论四个独立 Slide/画面阶段，共划分出 4 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Peering 与 Transit Gateway 的选型维度
时间范围：00:00–00:16
总结 / Summary
中文
VPC 对等连接（VPC Peering）和中转网关（Transit Gateway, TGW）都能连接多个 VPC，但在拓扑、混合连接（hybrid connectivity）、规模、延迟、带宽、安全组引用（security group referencing）、传递式路由（transitive routing）和总拥有成本（Total Cost of Ownership, TCO）上差异明显。选型应根据 VPC 数量、是否接入本地网络及是否需要中心化服务综合判断。
English
VPC Peering and Transit Gateway both connect VPCs, but they differ materially in topology, hybrid connectivity, scale, latency, bandwidth, security-group referencing, transitive routing, and total cost of ownership. The choice should reflect the number of VPCs, on-premises connectivity, and the need for centralized network services.
Transcript
00:00 Hello and welcome to this lecture.
00:01 So in this lecture I wanted to, uh, put down some differences between VPC peering and transit gateway
00:07 and give you some hints towards when to use what depending on their features.
00:13 So let's, uh, look at the differences between these two.
2. Architecture、Scale、Latency 与 Bandwidth
时间范围：00:16–02:40
总结 / Summary
中文
VPC Peering 是一对一点对点连接（one-to-one point-to-point connection）；少量 VPC 时简单，但数量增长会形成全网状拓扑（full-mesh topology）。TGW 是中心辐射模型（hub-and-spoke model），可把大量 VPC、站点到站点虚拟专用网络（Site-to-Site VPN）和 Direct Connect（DX）附件集中到一个路由中心。Peering 没有额外网络跳数，延迟更低，并主要受实例网络性能限制；TGW 增加一跳，并对每个附件有带宽上限。Slide 中的 125 个 Peering/每 VPC、5,000 个 TGW 附件和 50 Gbps/附件属于讲课时的配额示例，应核对当前 AWS 文档。安全组跨 VPC 引用在 Peering 中支持，TGW 的 VPC Attachment 从 2025 年起也增加了该能力。
English
VPC Peering is a one-to-one point-to-point connection. It is simple for a few VPCs but grows into a full mesh as the environment expands. A TGW uses a hub-and-spoke model and can centralize many VPC, Site-to-Site VPN, and Direct Connect attachments. Peering has no additional network hop, offering lower latency and bandwidth mainly constrained by the participating instances. A TGW adds a hop and has a per-attachment bandwidth limit. The slide's figures—125 peerings per VPC, 5,000 TGW attachments, and 50 Gbps per attachment—are lecture-time quota examples and should be verified against current AWS documentation. Cross-VPC security-group referencing is supported for peering and, from 2025, for TGW VPC attachments as well.
Transcript
00:16 So VPC peering and transit gateway with respect to the architecture.
00:20 If you understood VPC peering would provide you 1 to 1 connection.
00:25 That means if there are two VPCs, you need to have one VPC peering connection between them.
00:31 And if there are three, then you also need to have 1 to 1 connection between all these three.
00:36 So that makes it difficult if number of VPCs are growing.
00:40 But in case of Transit Gateway, it's a hub and spoke model where you can attach up to 5000 VPCs or
00:47 other connection to the transit gateway with respect to the hybrid connectivity.
00:51 As you know, VPC peering is just for connecting to VPCs, right?
00:56 However, transit gateways for connecting VPCs to even the hybrid network like on premise network over
01:03 a VPN or a direct connect.
01:05 Complexity wise, VPC peering is simple, but it is good for fewer number of VPCs.
01:11 However, Transit Gateway can handle many number of VPCs, and it actually simplifies your network architecture
01:19 with respect to the scale.
01:20 As of today, VPC peering has a limit of 125 peering connection per VPC.
01:27 However, Transit Gateway supports up to 5000 attachments.
01:31 Latency wise, I would say that VPC peering is better because there is no additional networking hop,
01:38 but in case of Transit Gateway as you know, it provisions the Eni into your subnets and that's where
01:44 you can see that there is an additional network hop bandwidth wise.
01:48 Again, VPC peering does not impose any bandwidth limits and you are restricted by the EC2 bandwidth
01:55 basically, which is doing the data transfer.
01:58 However, in case of transit gateway, there is a maximum limit of 50 gigabits per second per attachment
02:05 referencing security group, which means if you have two VPCs and you are writing a security group rule
02:12 for EC2 machine in one VPC, can you reference that security group in the security group of another
02:19 VPC?
02:19 Right.
02:20 So in case of VPC peering it is allowed.
02:23 And in Transit Gateway it wasn't initially allowed where you could refer the security group from across
02:28 VPCs.
02:29 But from 2025 transit gateway VPC attachments also supports referencing the security group.
02:38 So that's a new change.
02:40 So if you go to the VPC console and you try to create the transit gateway, there you will see this
3. 启用 TGW Security Group Referencing Support
时间范围：02:40–02:59
总结 / Summary
中文
创建中转网关（Transit Gateway, TGW）时，控制台提供安全组引用支持（Security Group Referencing Support）选项。该功能默认关闭，需要在 TGW 层启用，并确保相关 VPC Attachment 也满足支持条件。启用后，一个已附加 VPC 的安全组规则可引用另一个已附加 VPC 中的安全组，从而减少基于固定 CIDR 的规则维护。
English
The Transit Gateway creation console includes a Security Group Referencing Support option. It is disabled by default and must be enabled at the TGW level, with the relevant VPC attachments also meeting the feature requirements. Once enabled, a security-group rule in one attached VPC can reference a security group in another attached VPC, reducing reliance on fixed CIDR rules.
Transcript
02:46 option security group referencing support.
02:49 And it is disabled by default.
02:51 But then you can enable that.
02:54 So as I said this is a new change.
02:56 So just remember about it.
4. Subnet Reachability、Transitive Routing 与 TCO
时间范围：02:59–06:13
总结 / Summary
中文
VPC Peering 可让两个对等 VPC 中所有正确路由的子网直接通信，但不支持通过对等连接传递访问第三方网络设备，例如另一个 VPC 的互联网网关（Internet Gateway, IGW）或 NAT Gateway。TGW Attachment 只在所选可用区（Availability Zone, AZ）创建 TGW ENI；该 VPC 中其他 AZ 的子网仍可通过 VPC 内部路由到这些 ENI，但设计必须确保每个需要的 AZ 有附件子网。TGW 支持传递式路由，可构建集中互联网出口与混合连接。成本方面，Peering 无连接小时费，主要收数据传输费；TGW 既有每附件小时费又有每 GB 处理费。视频中的具体美元价格是当时示例。总体上，少量 VPC、低成本和最低延迟倾向 Peering；大规模、混合网络和中心化路由倾向 TGW。
English
VPC Peering allows correctly routed subnets in the two peer VPCs to communicate directly, but it does not provide transitive access to third-party resources such as an Internet Gateway or NAT Gateway in another VPC. A TGW attachment creates TGW ENIs only in the selected Availability Zones; subnets in other AZs can still reach those ENIs through VPC routing, but the attachment-subnet design must cover the required AZs. TGW supports transitive routing for centralized internet egress and hybrid connectivity. Peering has no hourly connection fee and mainly incurs data-transfer charges, while TGW adds a per-attachment hourly fee and per-GB processing fee. The dollar figures on the slide are historical examples. In general, a small, latency-sensitive, cost-conscious environment favors peering; large-scale, hybrid, centralized routing favors TGW.
Transcript
02:59 Subnet connectivity which means if you are connecting say two VPCs then virtual subnets can communicate
03:06 with each other across the VPCs.
03:08 Now, in case of VPC peering connection, you can connect any subnet to any subnet across the two VPCs
03:15 which are connected.
03:17 But as we have learned in case of Transit Gateway, it will depend on your availability zone in which
03:22 you are creating the Transit Gateway attachment.
03:25 So only the subnet, which are part of that particular AZ in which you are creating the attachment,
03:31 will be able to route traffic through the transit gateway, right.
03:35 Remember this point very important to consider.
03:38 Finally, transitive routing, which means can you access the other network elements from the connection
03:44 through the connection, whether VPC peering or transit gateway.
03:47 So in case of VPC peering we learn that there are.
03:50 These are the invalid scenarios where you can't access the internet gateway via the peering connection,
03:56 or Nat gateway through the peering connection, so it's not supported.
04:00 However, in case of Transit Gateway, because there is an Eni involved, the transitive routing is
04:05 possible.
04:06 That means you could have a centralized VPC in which you provision your, you know, internet gateways
04:11 or Nat gateway.
04:12 And then you have all these VPCs and you can route all your outbound internet traffic through that centralized
04:18 VPC.
04:19 Now, this is not possible in case of VPC peering connections.
04:23 Finally, and the most important thing the TCO how much it costs.
04:27 So VPC peering there is no separate cost for peering.
04:32 But what you pay is for the data transfer cost data transfer.
04:36 It's free within the AZ.
04:37 Earlier there was some charge, but after May 2021 there is no charge.
04:42 If the data remains in the same AZ across the two VPCs.
04:48 However, if subnets are in different AZ then there will be $0.01 data transfer charge in each direction.
04:57 And if the VPCs are across regions, then $0.02 data transfer charge would be applied.
05:05 In case of transit gateway, there is additional cost that is per attachment cost, which is like 20
05:10 4X7.
05:11 And then there is additional data transfer cost as well.
05:15 So even though you do not do the data transfer you will still pay for this attachment cost.
05:20 And for example for North Virginia region, that attachment cost is $0.05 per hour and $0.02 per GB
05:30 data transfer cost.
05:31 So if you look at this thing holistically, VPC peering is simpler to use.
05:37 And also it gives you some cost benefit.
05:40 But as you can see, if number of VPCs are more then it is difficult to handle that.
05:46 Moreover, it does not allow you to connect VPCs to the on premise network.
05:50 Now, if you want to simplify your network and you see that there are so many connections to handle,
05:55 it's better to go with the transit gateway.
05:58 But again, it comes with some additional costs there.
06:01 So that's it about the difference between the peering connection and transit gateway.
06:06 And I hope based on this you could make your architectural choices.
06:11 So thanks for watching.
整讲总结 / Overall Summary
中文
VPC 对等连接（VPC Peering）适合少量 VPC 的低延迟点对点通信：配置直接、无连接小时费，但不支持传递式路由（transitive routing）或原生混合连接（hybrid connectivity），规模扩大时全网状连接难以维护。中转网关（Transit Gateway, TGW）提供中心辐射路由（hub-and-spoke routing），可汇聚 VPC、VPN 和 Direct Connect，支持集中出口与跨网络传递，但增加一跳、附件带宽限制和附件/数据处理费用。TGW 现在也支持安全组引用（security group referencing），但默认需启用。选型核心是规模、中心化与混合网络需求，而不是单一功能。
English
VPC Peering suits low-latency point-to-point connectivity among a small number of VPCs. It is direct and has no hourly connection fee, but lacks transitive routing and native hybrid connectivity, and a full mesh becomes difficult to manage at scale. Transit Gateway provides hub-and-spoke routing across VPC, VPN, and Direct Connect attachments and enables centralized egress and transitive designs, but adds a hop, per-attachment bandwidth limits, and attachment and processing costs. TGW now also supports security-group referencing when enabled. The deciding factors are scale, centralization, and hybrid-network requirements rather than one isolated feature.
返回顶部 ↑