AWS Transit Gateway with Terraform: Hub-and-Spoke Networking at Scale

AWS Transit Gateway provides a regional virtual router that interconnects Amazon Virtual Private Clouds and on-premises networks through a hub-and-spoke model. Terraform is an open-source Infrastructure as a Code software tool where resources are defined using a declarative configuration language. With Terraform, code can be packaged and reused in the form of modules and it supports cloud infrastructure providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc.

Transit Gateway acts as a hub that allows you to connect VPCs and VPN connections, enabling centralized management of network routing and traffic between these resources. A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. The networking service uses a hub-and-spoke model to connect on-premises data centers and Amazon Virtual Private Clouds to a single gateway. With Transit Gateway, you can connect up to 5,000 VPCs and on-premises networks to a single gateway, making it easier to manage and scale your network as your business grows.

What Terraform and AWS Transit Gateway Are

Terraform is an open-source IaaC software tool where you define and create resources using providers in the declarative configuration language example JSON. With Terraform, you can package and reuse the code in the form of modules. It supports a number of cloud infrastructure providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc.

AWS Transit Gateway is a service that simplifies network connectivity for multiple Amazon Virtual Private Clouds and on-premises networks. It acts as a hub that allows you to connect VPCs and VPN connections, enabling centralized management of network routing and traffic between these resources.

A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.

Transit Gateway acts as a Regional virtual router for traffic flowing between your Virtual Private Clouds and on-premises networks. Transit Gateway simplifies how customers interconnect their networks to scale their AWS workloads. Transit Gateway reduces the number of connections needed to connect many VPCs, AWS accounts, and on-premises networks.

Why Transit Gateway Replaces Mesh Peering

Peering is wonderful, but it just does not scale well. Consider this diagram of an architecture with only five VPCs before implementing something like Transit VPC or Transit Gateway. When you start to have a lot of peering connections between multiple VPCs, in multiple regions, across multiple AWS accounts, managing the connections starts to get difficult.

One of the main benefits of using AWS Transit Gateway is that it helps you to reduce the complexity and cost of your network infrastructure.

Transit Gateway solves the complexity involved with creating and managing multiple VPC peering connections at scale. Transit Gateway's should be utilized whenever connectivity is required with more than two VPCs.

A transit gateway is an effective method of connecting multiple VPCs, Direct Connects, VPNs, and other networks. Transit gateways are also a good way to connect VPCs to shared services, such as NAT gateways, firewalls, and other security appliances. By using a transit gateway, the number of connections to and from VPCs can be reduced, which reduces the number of routes that need to be managed.

Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls.

This setup simplifies network architecture, reduces the number of peering connections, and provides a scalable and centralized solution for managing network traffic between multiple VPCs and external networks.

Core Terraform Modules for Transit Gateway

The module does not use default route tables by design - specify all the route tables explicitly through respective input variables.

A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.

Module Requirements and Providers

Requirements

Providers

Modules

No modules.

Resources

Inputs

Terraform AWS Modules Transit Gateway

Terraform module which creates Transit Gateway resources on AWS.

A complete example shows TGW in combination with the VPC module and Resource Access Manager.

Multi-account example shows TGW resources shared with different AWS accounts via Resource Access Manager.

Requirements

Providers

No modules.

Resources

Example configuration

module "tgw" { source = "terraform-aws-modules/transit-gateway/aws" name = "my-tgw" description = "My TGW shared with several other AWS accounts" enable_auto_accept_shared_attachments = true vpc_attachments = { vpc = { vpc_id = "vpc-1234556abcdef" subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"] dns_support = true ipv6_support = true tgw_routes = [ { destination_cidr_block = "30.0.0.0/16" }, { blackhole = true destination_cidr_block = "40.0.0.0/20" } ] } } ram_allow_external_principals = true ram_principals = [307990089504] tags = { Terraform = "true" Environment = "dev" } }

Practical Setup Steps with Terraform

Prerequisites

• AWS Account: You should have an active AWS account with the necessary permissions to create and manage resources.
• Terraform: Terraform is an infrastructure provisioning tool that you will need to install on your local machine.
• Visual Studio Code Editor Installed

Step#1: Create provider.tf file

The provider.tf file in Terraform is a configuration file that specifies the cloud provider and its corresponding plugin that Terraform will use to manage resources in that provider.

provider "aws" { region = "ap-south-1" profile= "default" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "5.43.0" } } }

Step#2: Create Web App VPC in Mumbai Region

The Vpc.tf file in Terraform configures an Amazon VPC in Mumbai, defining CIDR blocks, public and private subnets, an internet gateway for external access, route tables, and routes for internet-bound traffic.

resource "aws_vpc" "WEB_APP_VPC" { cidr_block = "10.0.0.0/16" tags = { Name = "WEB_APP_VPC" } } resource "aws_subnet" "WEB_APP_SUBNET" { vpc_id =

Configuration in this directory creates AWS Transit Gateway, attach VPC to it and share it with other AWS principals using Resource Access Manager.

To run this example you need to execute:

$ terraform init $ terraform plan $ terraform apply terraform destroy when you don't need these resources.

Requirements

Providers

Modules

Outputs

Transit Gateway Sharing and Multi-Account Patterns

Transit Gateway reduces the number of connections needed to connect many VPCs, AWS accounts, and on-premises networks. Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls.

Sharing is implemented with Resource Access Manager. The complete example shows TGW in combination with the VPC module and Resource Access Manager. Multi-account example shows TGW resources shared with different AWS accounts via Resource Access Manager.

The module creates

• awsec2transit_gateway.this
• awsec2transitgatewayroute_table.this
• awsramprincipal_association.this
• awsramresource_association.this
• awsramresource_share.this

and supports autoacceptshared_attachments.

Conclusion

Conclusion

Using Terraform to provision AWS Transit Gateway creates a centralized hub-and-spoke network that replaces quadratic growth of VPC peering with a single managed gateway. The Terraform module approach enforces explicit route table definitions, removing reliance on default route tables by design, and provides controlled inputs for BGP Autonomous System Number, DNS support, and auto acceptance of shared attachments.

Operational scale is achieved through support for up to 5,000 VPCs and on-premises networks per gateway, inter-Region peering via AWS Global Infrastructure, and Resource Access Manager sharing across accounts. The Terraform AWS Modules implementation adds VPC attachments with explicit subnet lists, DNS and IPv6 support toggles, and per-attachment tgw_routes including blackhole routes.

From a configuration perspective, the provider setup pins AWS provider versions and region, while module requirements enforce terraform >= 1.5.7 and aws >= 6.28 for the community module, and terraform >= 1.5.0 and aws ~> 5.17 for the Palo Alto Networks module. Resources span transit gateway creation, route tables, route table associations and propagations, VPC attachments, and RAM principal and resource associations.

This combination of declarative IaC, hub-and-spoke topology, and explicit routing control delivers reduced connection count, centralized routing management, and scalable multi-account connectivity for AWS workloads.

Sources

1. https://www.fosstechnix.com/aws-vpc-transit-gateway-using-terraform/
2. https://awstip.com/aws-transit-gateway-using-terraform-fb7731e94e58
3. https://pan.dev/terraform/docs/swfw/aws/vmseries/modules/transit_gateway/
4. https://docs.gruntwork.io/reference/modules/terraform-aws-vpc/transit-gateway/
5. https://github.com/terraform-aws-modules/terraform-aws-transit-gateway
6. https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/complete