Lecture 93: Transit Gateway Sharing
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:27
- 来源：Udemy Lecture 33514986
- Slide 数量：3
- 画面切换：00:30、02:30
扫描说明
逐条检查了 Udemy 页面中的 123 条 Transcript cue，并对全长约 5:27 的视频画面逐段扫描。依据标题页、AWS RAM 共享流程，以及共享 TGW 的 Attachment/Route Table/AZ ID 注意事项三张独立 Slide，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 跨 AWS Account 共享 Transit Gateway
时间范围：00:00–00:30
总结 / Summary
中文
中转网关共享（Transit Gateway Sharing）允许一个 AWS 账户拥有中转网关（Transit Gateway, TGW），其他账户把各自 VPC 附加到该 TGW。共享可以发生在同一 AWS Organizations 内，也可跨不同组织与外部账户；TGW 所有者保留中心路由治理，而参与账户管理自己的 VPC Attachment。VPN、Direct Connect 和可用区映射还有额外限制。
English
Transit Gateway Sharing allows one AWS account to own the TGW while other accounts attach their own VPCs to it. Sharing can occur within AWS Organizations or with accounts in other organizations. The TGW owner retains centralized routing governance, while participant accounts manage their VPC attachments. VPN, Direct Connect, and Availability Zone mapping have additional restrictions.
Transcript
00:00 Hello, and welcome to this lecture
00:01 transit gateway sharing
00:02 or you can say sharing the transit gateway.
00:05 Basically, as the title suggests,
00:07 what it means is you can share your transit gateways
00:10 across AWS accounts, and then it is possible
00:14 that you can connect your VPCs
00:16 from different accounts to the transit gateway,
00:18 which is owned by different AWS account.
00:21 But there are certain caveats
00:23 when it comes to attachments like VPN or a direct connect.
00:26 And we'll talk about all those things in this lecture.
00:30 So very first thing, how do you share transit gateways?
2. AWS RAM 的 Resource Share 流程
时间范围：00:30–02:30
总结 / Summary
中文
AWS 资源访问管理器（AWS Resource Access Manager, AWS RAM）用于安全共享 TGW 等 AWS 资源。创建资源共享（resource share）时，先选择要共享的资源，再指定每类资源允许的操作权限（permissions），随后选择主体（principal），例如 AWS 账户、组织单元（Organizational Unit, OU）、整个 AWS Organizations、IAM 角色或用户。RAM 按这些权限把资源暴露给指定主体。收到 TGW 共享的账户可为自己的 VPC 创建附件，使多个账户的 VPC 接入同一中心网关。
English
AWS Resource Access Manager securely shares resources such as a TGW. A resource share selects the resources, defines the permitted actions for each resource type, and identifies principals such as AWS accounts, Organizational Units, an AWS Organization, IAM roles, or users. RAM exposes the resources according to those permissions. An account receiving the TGW share can create VPC attachments for its own VPCs, connecting multiple accounts to one central gateway.
Transcript
00:33 So for this, you have to use AWS
00:35 Resource Access Manager that is RAM,
00:38 and RAM allows you to share various AWS resources,
00:43 including the transit gateway.
00:45 And those resources can be shared
00:47 across AWS account in your organization
00:50 or you could also share
00:52 with other AWS account in other AWS organization.
00:56 So RAM is an essential service to share
01:01 AWS resources securely with other AWS accounts.
01:04 So generic flow, how do you use
01:06 AWS Resource Access Manager is that you first select
01:10 the resources that you want to share.
01:12 And then you are going to define the permissions,
01:14 like what actions are permitted
01:16 on these shared resources.
01:18 So you are going to share this resource
01:19 with other AWS accounts.
01:21 So the user in that AWS account can perform
01:24 only certain actions that you can define
01:26 with these IAM permissions
01:28 when you share the resources.
01:30 Then you specify AWS accounts
01:32 or organization units or AWS organizations or IAM roles
01:36 and users with whom you want to share these resources.
01:40 And once that's done,
01:41 all resources that you want to share
01:43 will be shared with specified
01:46 principle entities into AWS,
01:49 and then those users or roles will only get access
01:52 to the actions that you have mentioned
01:54 in your permissions boundary.
01:56 And that's how the AWS Resource Access Manager works.
02:00 And as I said, transit gateways also and resource,
02:04 which can be shared using AWS Resource Access Manager.
02:07 Now, when you share transit gateway using RAM
02:11 with other AWS account, then the other AWS account
02:15 owner can connect the VPCs from that account
02:18 with the transit gateway,
02:20 which has been shared with that account.
02:22 So it's possible that you can connect VPCs
02:25 across different AWS accounts.
02:27 Now, a few caveats and important to know,
3. 共享 TGW 的 VPN、DX、Route Table 与 AZ ID 限制
时间范围：02:30–05:27
总结 / Summary
中文
站点到站点虚拟专用网络附件（Site-to-Site VPN attachment）必须创建在 TGW 所有者账户中，不能由参与账户跨账户直接创建；Direct Connect 网关附件（Direct Connect Gateway attachment）则可与 Direct Connect Gateway 位于相同或不同账户。参与账户不能创建、修改或删除 TGW 路由表（TGW route table），也不能控制路由传播（route propagation）与关联（route-table association）；这些权限属于 TGW 所有者。跨账户选择附件子网时，不应依赖 us-east-1a 这类可用区名称，因为同一名称在不同账户可能映射到不同物理 AZ；应使用稳定的可用区 ID（Availability Zone ID, AZ ID），例如 use1-az1，确保各账户选择同一物理 AZ，并避免不必要的跨 AZ 传输费。
English
A Site-to-Site VPN attachment must be created in the account that owns the TGW; a participant cannot create that attachment cross-account. A Direct Connect Gateway attachment, however, can use a Direct Connect Gateway from the same or a different account. Participant accounts cannot create, modify, or delete TGW route tables or control route propagation and association; those functions remain with the TGW owner. When selecting attachment subnets across accounts, do not rely on names such as us-east-1a, because the same name can map to different physical AZs in different accounts. Use the stable Availability Zone ID, such as use1-az1, to select the same physical AZ and avoid unintended inter-AZ charges.
Transcript
02:30 while you use AWS Resource Access Manager
02:33 to share the transit gateways,
02:35 first, if you are using the site-to-site
02:37 VPN attachment to the transit gateway,
02:40 then you have to make sure
02:41 that the VPN attachment is created
02:43 in the same account as the transit gateway owner account.
02:46 So you can't cross connect the VPN attachment
02:49 across different AWS accounts.
02:51 Further, if you're using a direct connect gateway
02:54 to connect transit gateway to the direct connect,
02:56 then you could also use direct connect gateway
02:59 from other AWS account.
03:01 So again, cross account connection is possible
03:04 in case of direct connect gateway.
03:07 Now, when a transit gateway shared with the AWS account,
03:11 the other AWS account cannot really create,
03:13 modify, delete the transit gateway route tables,
03:16 and it cannot even enable or disability
03:18 the route propagations and the associations.
03:21 So that means the control of the route
03:24 is with the owner of the transit gateway.
03:28 And finally, you need to make sure
03:30 that when you choose the availability zone
03:34 into the other VPCs which are going to connect
03:38 to your transit gateway.
03:40 Now in that VPC, you would have to select
03:42 availability zone where the transit gateway
03:43 attachments are created, right?
03:45 Now if you know the way AWS names
03:48 the availability zone is something like us-east-1A,
03:53 us-east-1B, likewise, right?
03:56 Now for you or say for one account us-east-1A
04:01 maybe a one availability zone,
04:04 but in the same region,
04:05 if there is another AWS account,
04:07 then us-east-1A maybe a different availability zone,
04:11 and probably AWS has done in that way
04:14 because then otherwise everybody
04:16 would keep launching the instances,
04:18 maybe only first AZ,
04:20 and that would make some kind of imbalance
04:23 between resource capacity in those AZ.
04:26 So, which means you shouldn't rely
04:28 on the AZ name to identify a unique,
04:30 AZ across different accounts,
04:32 but rather AWS has assigned AZ IDs to the AZ
04:37 and those remains constant irrespective
04:39 of different AWS account.
04:41 So instead of us-east-1A,
04:44 you should look at the AZ ID
04:45 and which could look like use1-az1, so us-east-1-az1.
04:52 So this is now AZ ID.
04:54 And if you refer this AZ ID
04:56 into any of the AWS account in that region,
04:59 then all will mean the same AZ.
05:01 So you are making sure that the transit gateway attachments
05:03 are created in the same AZ.
05:05 And this is important because you know
05:07 transit gateway has AZ affinity.
05:09 Otherwise, you might have additional
05:10 AZ data transfer charges.
05:13 Okay, so that's it about sharing the transit gateways.
05:16 It's a small topic, but important to know
05:18 that you can share transit gateways
05:20 across AWS accounts and AWS organizations as well.
05:24 So thanks for watching.
整讲总结 / Overall Summary
中文
中转网关共享（Transit Gateway Sharing）通过 AWS 资源访问管理器（AWS Resource Access Manager, AWS RAM）把一个账户拥有的 TGW 分享给其他账户、组织单元（Organizational Unit, OU）或 AWS Organizations。参与账户可创建自己的 VPC Attachment，但 TGW 所有者独占路由表、传播和关联控制。站点到站点 VPN 附件（Site-to-Site VPN attachment）必须属于 TGW 所有者账户；Direct Connect Gateway 可以跨账户。跨账户可用区名称并不稳定，创建附件时应使用可用区 ID（Availability Zone ID, AZ ID）对齐物理 AZ。
English
Transit Gateway Sharing uses AWS Resource Access Manager to share a TGW owned by one account with other accounts, Organizational Units, or AWS Organizations. Participants can create VPC attachments, but the TGW owner exclusively controls route tables, propagation, and association. Site-to-Site VPN attachments must belong to the TGW-owner account, while a Direct Connect Gateway can be cross-account. Availability Zone names are not stable across accounts, so attachment subnets should be aligned with Availability Zone IDs.
返回顶部 ↑