Terraform AWS Modules for Building Transit Gateway Hub-and-Spoke Networks

Terraform provides a declarative approach to provisioning AWS Transit Gateway resources at scale, replacing manual console configuration with version-controlled, reusable modules. Transit Gateway acts as a regional virtual router that centralizes connectivity between multiple VPCs, VPN connections, Direct Connect attachments, and on-premises networks. Using Terraform modules accelerates adoption of hub-and-spoke topologies, multi-account sharing via Resource Access Manager, and explicit route table management.

Introduction

AWS Transit Gateway is a network transit hub that interconnects virtual private clouds and on-premises networks. As cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure. All network traffic between AWS data centers is automatically encrypted at the physical layer. Terraform modules encapsulate the creation of the transit gateway, route tables, VPC attachments, RAM shares, and associated routes, enabling consistent deployment across development and production environments.

What Is Terraform and Why It Matters for Transit Gateway

Terraform is an open-source Infrastructure as Code software tool where you define and create resources using providers in the declarative configuration language example JSON. With Terraform, you can package and reuse the code in the form of modules. It supports a number of cloud infrastructure providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc.

For Transit Gateway workloads, Terraform modules remove repetitive boilerplate for aws_ec2_transit_gateway, aws_ec2_transit_gateway_route_table, aws_ec2_transit_gateway_vpc_attachment, and RAM resources. Module inputs expose BGP Autonomous System Number, DNS support, IPv6 support, auto-accept shared attachments, and per-VPC route definitions.

What Is AWS Transit Gateway

AWS Transit Gateway is a service that simplifies network connectivity for multiple Amazon Virtual Private Clouds and on-premises networks. It acts as a hub that allows you to connect VPCs and VPN connections, enabling centralized management of network routing and traffic between these resources.

A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.

A Transit Gateway acts as a Regional virtual router for traffic flowing between your Virtual Private Clouds and on-premises networks. Transit Gateway simplifies how customers interconnect their networks to scale their AWS workloads. Transit Gateway reduces the number of connections needed to connect many VPCs, AWS accounts, and on-premises networks.

Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls.

Transit Gateway Versus VPC Peering

Transit Gateway solves the complexity involved with creating and managing multiple VPC peering connections at scale. Transit Gateway's should be utilized whenever connectivity is required with more than two VPCs.

Peering is wonderful, but it just doesn’t scale well. Consider this diagram of an architecture with only five VPCs before implementing something like Transit VPC or Transit Gateway. When you start to have a lot of peering connections between multiple VPCs, in multiple regions, across multiple AWS accounts, managing the connections starts to get difficult.

With Transit Gateway, you can connect up to 5,000 VPCs and on-premises networks to a single gateway, making it easier to manage and scale your network as your business grows. The hub-and-spoke model reduces the number of routes that need to be managed compared to full mesh peering.

Core Module Implementations

Multiple community and vendor modules exist for Transit Gateway provisioning.

Terraform AWS Modules Transit Gateway

A Terraform module for deploying AWS Transit Gateways. The module does not use default route tables by design - specify all the route tables explicitly through respective input variables.

Resources created by the module include:

aws_ec2_transit_gateway.this
aws_ec2_transit_gateway_route_table.this
aws_ram_principal_association.this
aws_ram_resource_association.this
aws_ram_resource_share.this

Data sources include aws_ec2_transit_gateway.this and aws_ec2_transit_gateway_route_table.this.

Requirements:

Name	Version
terraform	>= 1.5.0, < 2.0.0
aws	~> 5.17

Providers:

Name	Version
aws	~> 5.17

Inputs relevant to Transit Gateway configuration include:

Name	Description	Type	Default	Required
asn	BGP Autonomous System Number of the AWS Transit Gateway	number	65200	no
autoacceptshared_attachments	See the provider documentation	string	null	no
create	Trigger module mode between creating a new TGW or retrieving an existing one	bool	true	no
dns_support	See the provider documentation

Gruntwork Terraform AWS VPC Transit Gateway Module

This Terraform module creates a transit gateway resource. A transit gateway is an effective method of connecting multiple VPCs, Direct Connects, VPNs, and other networks. Transit gateways are also a good way to connect VPCs to shared services, such as NAT gateways, firewalls, and other security appliances. By using a transit gateway, the number of connections to and from VPCs can be reduced, which reduces the number of routes that need to be managed.

The module emphasizes explicit route table management and integration with VPC Core Concepts for core networking components and topologies.

Terraform AWS Modules Official Transit Gateway Module

Terraform module which creates Transit Gateway resources on AWS.

The module supports multi-account sharing via Resource Access Manager, VPC attachments with per-attachment routes, and tagging.

Requirements:

Name	Version
terraform	>= 1.5.7
aws	>= 6.28

Providers:

Name	Version
aws	>= 6.28

Resources created:

Name	Type
awsec2tag.this	resource
awsec2transit_gateway.this	resource
awsec2transitgatewayroute.this	resource
awsec2transitgatewayroute_table.this	resource
awsec2transitgatewayroutetableassociation.this	resource
awsec2transitgatewayroutetablepropagation.this	resource
awsec2transitgatewayvpc_attachment.this	resource
awsramprincipal_association.this	resource
awsramresource_association.this	resource

Example usage:

hcl module "tgw" { source = "terraform-aws-modules/transit-gateway/aws" name = "my-tgw" description = "My TGW shared with several other AWS accounts" enable_auto_accept_shared_attachments = true vpc_attachments = { vpc = { vpc_id = "vpc-1234556abcdef" subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"] dns_support = true ipv6_support = true tgw_routes = [ { destination_cidr_block = "30.0.0.0/16" }, { blackhole = true destination_cidr_block = "40.0.0.0/20" } ] } } ram_allow_external_principals = true ram_principals = [307990089504] tags = { Terraform = "true" Environment = "dev" } }

Complete example shows TGW in combination with the VPC module and Resource Access Manager. Multi-account example shows TGW resources shared with different AWS accounts via Resource Access Manager.

Architecture Patterns With Terraform

A typical pattern creates vpc_a, vpc_b and vpc_c with non-overlapping cidrs, then attaches each to a central Transit Gateway.

In our previous post, we implemented an AWS networking concept, establishing a peering connection between two Virtual Private Clouds. Now, we're stepping up our game by exploring how to connect multiple VPCs using the powerful AWS Transit Gateway. We'll walk through the process using Terraform modules to create distinct components seamlessly.

The Transit gateway acts like a hub and spoke model where each spoke VPC connects to the single gateway from where the traffic routing is managed by TGW. One of the main benefits of using AWS Transit Gateway is that it helps you to reduce the complexity and cost of your network infrastructure.

Implementing Multi-VPC Connectivity

When building with Terraform, the workflow typically includes:

Provisioning the Transit Gateway with desired ASN, DNS support, and auto-accept settings
Creating explicit route tables and associating them with attachments
Defining VPC attachments per spoke with subnet IDs, DNS and IPv6 support
Adding routes for destination CIDR blocks, including blackhole routes for traffic control
Configuring RAM resource shares for cross-account attachment acceptance

The module does not use default route tables by design - specify all the route tables explicitly through respective input variables. This explicit model prevents accidental traffic leakage and forces intent-based routing.

Security and Isolation Considerations

Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls. By using a transit gateway, the number of connections to and from VPCs can be reduced, which reduces the number of routes that need to be managed.

Modules support tagging for cost allocation, enable_auto_accept_shared_attachments for automation, and ram_allow_external_principals for sharing with external AWS accounts.

Conclusion

Terraform modules for AWS Transit Gateway provide a repeatable, auditable path to hub-and-spoke networking at scale. The official terraform-aws-modules/transit-gateway/aws module and the Palo Alto Networks module for VM-Series deployments both emphasize explicit route table definitions, RAM-based sharing, and fine-grained VPC attachment controls. Gruntwork and community examples reinforce that Transit Gateway reduces connection sprawl compared to VPC peering, supports up to thousands of VPC attachments, and integrates with shared services like NAT gateways and firewalls.

Adopting these modules eliminates manual configuration drift, enforces consistent tagging and security posture, and allows infrastructure teams to evolve from two-VPC peering to multi-region, multi-account transit architectures without rebuilding routing logic from scratch. Explicit route management, version-pinned providers, and module composition remain the key operational practices for production Transit Gateway deployments.