Terraform provides declarative configuration for AWS infrastructure, and AWS Transit Gateway provides a hub for interconnecting multiple VPCs and on-premises networks. Using Terraform to create and manage a Transit Gateway simplifies network connectivity at scale while centralizing routing control.
Terraform is an open-source Infrastructure as Code software tool where you define and create resources using providers in the declarative configuration language example JSON. With Terraform, you can package and reuse the code in the form of modules. It supports a number of cloud infrastructure providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc.
AWS Transit Gateway is a service that simplifies network connectivity for multiple Amazon Virtual Private Clouds (VPCs) and on-premises networks. It acts as a hub that allows you to connect VPCs and VPN connections, enabling centralized management of network routing and traffic between these resources.
Core Concepts of AWS Transit Gateway
A Transit Gateway acts as a Regional virtual router for traffic flowing between your Virtual Private Clouds (VPCs) and on-premises networks. Transit Gateway simplifies how customers interconnect their networks to scale their AWS workloads. Transit Gateway reduces the number of connections needed to connect many VPCs, AWS accounts, and on-premises networks. Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls.
A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.
Transit Gateway solves the complexity involved with creating and managing multiple VPC peering connections at scale. Transit Gateway's should be utilized whenever connectivity is required with more than two VPCs.
A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. The networking service uses a hub-and-spoke model to connect on-premises data centers and Amazon Virtual Private Clouds (VPCs) to a single gateway. With Transit Gateway, you can connect up to 5,000 VPCs and on-premises networks to a single gateway, making it easier to manage and scale your network as your business grows.
Why Transit Gateway is preferred over peering:
Peering is wonderful, but it just doesn’t scale well. Consider this diagram of an architecture with only five VPCs before implementing something like Transit VPC or Transit Gateway. When you start to have a lot of peering connections between multiple VPCs, in multiple regions, across multiple AWS accounts, managing the connections starts to get difficult
A transit gateway is an effective method of connecting multiple VPCs, Direct Connects, VPNs, and other networks. Transit gateways are also a good way to connect VPCs to shared services, such as NAT gateways, firewalls, and other security appliances. By using a transit gateway, the number of connections to and from VPCs can be reduced, which reduces the number of routes that need to be managed.
This setup simplifies network architecture, reduces the number of peering connections, and provides a scalable and centralized solution for managing network traffic between multiple VPCs and external networks.
Different regions can be connected to the Transit Gateway, enabling centralized network connectivity management.
Prerequisites for Terraform Transit Gateway Setup
Before deploying, the following are required:
- AWS Account: You should have an active AWS account with the necessary permissions to create and manage resources.
- Terraform: Terraform is an infrastructure provisioning tool that you’ll need to install on your local machine.
- Visual Studio Code Editor Installed
Provider configuration establishes the connection to AWS.
hcl
provider "aws" {
region = "ap-south-1"
profile= "default"
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.43.0"
}
}
}
A VPC example for a web application in Mumbai region illustrates the foundation:
hcl
resource "aws_vpc" "WEB_APP_VPC" {
cidr_block = "10.0.0.0/16"
tags = {
Name = "WEB_APP_VPC"
}
}
The Vpc.tf file in Terraform configures an Amazon VPC in Mumbai, defining CIDR blocks, public and private subnets, an internet gateway for external access, route tables, and routes for internet-bound traffic.
Terraform Module Structure for Transit Gateway
The Terraform module creates a transit gateway resource. A transit gateway is an effective method of connecting multiple VPCs, Direct Connects, VPNs, and other networks. Transit gateways are also a good way to connect VPCs to shared services, such as NAT gateways, firewalls, and other security appliances.
The module does not use default route tables by design - specify all the route tables explicitly through respective input variables.
Module Requirements and Providers
For the Palo Alto Networks module:
| Name | Version |
|---|---|
| terraform | >= 1.5.0, < 2.0.0 |
| aws | ~> 5.17 |
| Name | Version |
|---|---|
| aws | ~> 5.17 |
Modules:
No modules.
Resources Created by the Module
| Name | Type |
|---|---|
| awsec2transit_gateway.this | resource |
| awsec2transitgatewayroute_table.this | resource |
| awsramprincipal_association.this | resource |
| awsramresource_association.this | resource |
| awsramresource_share.this | resource |
| awsec2transit_gateway.this | data source |
| awsec2transitgatewayroute_table.this | data source |
For the terraform-aws-modules transit-gateway module:
| Name | Version |
|---|---|
| terraform | >= 1.5.7 |
| aws | >= 6.28 |
| Name | Version |
|---|---|
| aws | >= 6.28 |
No modules.
| Name | Type |
|---|---|
| awsec2tag.this | resource |
| awsec2transit_gateway.this | resource |
| awsec2transitgatewayroute.this | resource |
| awsec2transitgatewayroute_table.this | resource |
| awsec2transitgatewayroutetableassociation.this | resource |
| awsec2transitgatewayroutetablepropagation.this | resource |
| awsec2transitgatewayvpc_attachment.this | resource |
| awsramprincipal_association.this | resource |
| awsramresource_association.this | resource |
Inputs
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| asn | BGP Autonomous System Number of the AWS Transit Gateway. | number | 65200 | no |
| autoacceptshared_attachments | See the provider documentation. | string | null | no |
| create | Trigger module mode between creating a new TGW or retrieving an existing one. | bool | true | no |
| dns_support | See the provider documentation |
Usage Patterns and Examples
A common usage pattern deploys two VPCs and establishes connections between them using the TGW. The Transit gateway acts like a hub and spoke model where each spoke VPC connects to the single gateway from where the traffic routing is managed by TGW.
One of the main benefits of using AWS Transit Gateway is that it helps you to reduce the complexity and cost of your network infrastructure.
Complete example shows TGW in combination with the VPC module and Resource Access Manager (RAM).
Multi-account example shows TGW resources shared with different AWS accounts (via Resource Access Manager (RAM)).
Example configuration for sharing:
hcl
module "tgw" {
source = "terraform-aws-modules/transit-gateway/aws"
name = "my-tgw"
description = "My TGW shared with several other AWS accounts"
enable_auto_accept_shared_attachments = true
vpc_attachments = {
vpc = {
vpc_id = "vpc-1234556abcdef"
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
dns_support = true
ipv6_support = true
tgw_routes = [
{
destination_cidr_block = "30.0.0.0/16"
},
{
blackhole = true
destination_cidr_block = "40.0.0.0/20"
}
]
}
}
ram_allow_external_principals = true
ram_principals = [307990089504]
tags = {
Terraform = "true"
Environment = "dev"
}
}
Configuration in this directory creates AWS Transit Gateway, attach VPC to it and share it with other AWS principals using Resource Access Manager (RAM).
To run this example you need to execute:
bash
$ terraform init
$ terraform plan
$ terraform apply
terraform destroy
when you don't need these resources.
Module dependency table for the complete example:
| Name | Source | Version |
|---|---|---|
| tgw | ../../ | n/a |
| vpc1 | terraform-aws-modules/vpc/aws | ~> 6.0 |
| vpc2 | terraform-aws-modules/vpc/aws | ~> 6.0 |
Data sources used:
| Name | Type |
|---|---|
| awsavailabilityzones.available | data source |
Outputs provided:
| Name | Description |
|---|---|
| ec2transitgateway_arn | EC2 Transit Gateway Amazon Resource Name (ARN) |
| ec2transitgatewayassociationdefaultroutetable_id | Identifier of the default association route table |
| ec2transitgateway_id | EC2 Transit Gateway identifier |
| ec2transitgatewayownerid | Identifier of the AWS account that owns the EC2 Transit Gateway |
| ec2transitgatewaypropagationdefaultroutetable_id | Identifier of the default propagation route table |
| ec2transitgatewayrouteids | List of EC2 Transit Gateway Route Table identifier combined with destination |
| ec2transitgatewayroutetable_association | Map of EC2 Transit Gateway Route Table Association attributes |
| ec2transitgatewayroutetableassociationids | List of EC2 Transit Gateway Route Table Association identifiers |
Step by Step Deployment Flow
Step#1:Create provider.tf file
The provider.tf file in Terraform is a configuration file that specifies the cloud provider and its corresponding plugin that Terraform will use to manage resources in that provider.
Step#2:Create Web App VPC in Mumbai Region
The Vpc.tf file in Terraform configures an Amazon VPC in Mumbai, defining CIDR blocks, public and private subnets, an internet gateway for external access, route tables, and routes for internet-bound traffic.
Summary view of the terraform files in VS code is used to verify the structure before applying.
In this article, we’ll use Terraform to set up an AWS VPC Transit Gateway, enabling seamless connectivity and communication between multiple VPCs within your AWS infrastructure.
For usage examples, check out the examples folder.
For example usage, please refer to the examples directory.
Conclusion
Terraform Transit Gateway implementation delivers centralized, scalable network connectivity for AWS environments. The hub-and-spoke model reduces the number of connections to and from VPCs, reduces the number of routes that need to be managed, and provides centralized management of network routing and traffic between resources.
The module approach allows packaging and reuse of code in the form of modules, with support for providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc. Explicit route table specification avoids reliance on defaults, while Resource Access Manager integration enables multi-account sharing with external principals.
With Transit Gateway, up to 5,000 VPCs and on-premises networks can be connected to a single gateway. Inter-Region peering connects transit gateways together using the AWS Global Infrastructure, enabling centralized network connectivity management across regions.
Terraform configuration remains declarative and repeatable, with provider requirements such as terraform >= 1.5.0, < 2.0.0 and aws ~> 5.17 for specific modules, and terraform >= 1.5.7 and aws >= 6.28 for the community transit-gateway module. The resources created span transit gateway instances, route tables, route table associations, VPC attachments, and RAM sharing associations, all manageable through a single Terraform state.