Terraform enables declarative definition of AWS Transit Gateway resources to interconnect Virtual Private Clouds and on-premises networks. Transit Gateway acts as a regional virtual router that centralizes routing between many VPCs, Direct Connects, VPNs, and other networks. Using Terraform modules, attachments, route tables, and Resource Access Manager sharing can be expressed as code, reducing manual configuration and enabling reuse across accounts and regions.
What Terraform and AWS Transit Gateway Are
Terraform is an open-source Infrastructure as Code software tool where you define and create resources using providers in a declarative configuration language. With Terraform you can package and reuse code in the form of modules. It supports a number of cloud infrastructure providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc.
AWS Transit Gateway is a service that simplifies network connectivity for multiple Amazon Virtual Private Clouds and on-premises networks. It acts as a hub that allows you to connect VPCs and VPN connections, enabling centralized management of network routing and traffic between these resources. A transit gateway is an effective method of connecting multiple VPCs, Direct Connects, VPNs, and other networks. Transit gateways are also a good way to connect VPCs to shared services, such as NAT gateways, firewalls, and other security appliances. By using a transit gateway, the number of connections to and from VPCs can be reduced, which reduces the number of routes that need to be managed.
A Transit Gateway acts as a Regional virtual router for traffic flowing between your Virtual Private Clouds and on-premises networks. Transit Gateway simplifies how customers interconnect their networks to scale AWS workloads. Transit Gateway reduces the number of connections needed to connect many VPCs, AWS accounts, and on-premises networks. Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls.
Why Transit Gateway Replaces VPC Peering
Transit Gateway solves the complexity involved with creating and managing multiple VPC peering connections at scale. Transit Gateway should be utilized whenever connectivity is required with more than two VPCs.
Peering is wonderful, but it just does not scale well. Consider an architecture with only five VPCs before implementing something like Transit VPC or Transit Gateway. When you start to have a lot of peering connections between multiple VPCs, in multiple regions, across multiple AWS accounts, managing the connections starts to get difficult.
The Transit gateway acts like a hub and spoke model where each spoke VPC connects to the single gateway from where the traffic routing is managed by TGW. One of the main benefits of using AWS Transit Gateway is that it helps you to reduce the complexity and cost of your network infrastructure.
A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. The networking service uses a hub-and-spoke model to connect on-premises data centers and Amazon Virtual Private Clouds to a single gateway. With Transit Gateway, you can connect up to 5,000 VPCs and on-premises networks to a single gateway, making it easier to manage and scale your network as your business grows.
Core Architecture and Hub-and-Spoke Model
Transit Gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.
This setup simplifies network architecture, reduces the number of peering connections, and provides a scalable and centralized solution for managing network traffic between multiple VPCs and external networks. Different regions can be connected to the Transit Gateway, enabling centralized network connectivity management.
The key concepts are attachments, how VPCs connect, route tables, which VPCs can reach each other, and propagations, how routes spread automatically. For production setups, use custom route tables to enforce network isolation between environments.
Terraform Module Landscape for Transit Gateway
A Terraform module for deploying AWS Transit Gateways exists that does not use default route tables by design. Specify all the route tables explicitly through respective input variables.
A Terraform module which creates Transit Gateway resources on AWS is available. Complete example shows TGW in combination with the VPC module and Resource Access Manager. Multi-account example shows TGW resources shared with different AWS accounts via Resource Access Manager.
Requirements for one module variant:
| Name | Version |
|---|---|
| terraform | >= 1.5.0, < 2.0.0 |
| aws | ~> 5.17 |
Providers:
| Name | Version |
|---|---|
| aws | ~> 5.17 |
Modules:
| No modules. |
Resources:
| Name | Type |
|---|---|
| awsec2transit_gateway.this | resource |
| awsec2transitgatewayroute_table.this | resource |
| awsramprincipal_association.this | resource |
| awsramresource_association.this | resource |
| awsramresource_share.this | resource |
| awsec2transit_gateway.this | data source |
| awsec2transitgatewayroute_table.this | data source |
Inputs:
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| asn | BGP Autonomous System Number of the AWS Transit Gateway. | number | 65200 | no |
| autoacceptshared_attachments | See the provider documentation. | string | null | no |
| create | Trigger module mode between creating a new TGW or retrieving an existing one. | bool | true | no |
| dns_support | See the provider documentation |
A second module variant shows different version constraints:
| Name | Version |
|---|---|
| terraform | >= 1.5.7 |
| aws | >= 6.28 |
Name | Version
| aws | >= 6.28 |
No modules.
Resources:
| Name | Type |
|---|---|
| awsec2tag.this | resource |
| awsec2transit_gateway.this | resource |
| awsec2transitgatewayroute.this | resource |
| awsec2transitgatewayroute_table.this | resource |
| awsec2transitgatewayroutetableassociation.this | resource |
| awsec2transitgatewayroutetablepropagation.this | resource |
| awsec2transitgatewayvpc_attachment.this | resource |
| awsramprincipal_association.this | resource |
| awsramresource_association.this | resource |
Explicit Route Tables and Design Decisions
The module does not use default route tables by design. Specify all the route tables explicitly through respective input variables. This forces explicit design of which VPCs can reach each other and how traffic is forwarded to security appliances.
Transit Gateway can also be used to isolate workloads by attaching VPCs and on-premises networks to different route tables which can send traffic to security appliances, such as virtual firewalls. Using a transit gateway, the number of connections to and from VPCs can be reduced, which reduces the number of routes that need to be managed.
Provider Configuration and Prerequisites
Prerequisites for a typical setup are:
- AWS Account: You should have an active AWS account with the necessary permissions to create and manage resources.
- Terraform: Terraform is an infrastructure provisioning tool that you will need to install on your local machine.
- Visual Studio Code Editor Installed
The provider.tf file in Terraform is a configuration file that specifies the cloud provider and its corresponding plugin that Terraform will use to manage resources in that provider.
provider "aws" {
region = "ap-south-1"
profile= "default"
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.43.0"
}
}
}
Terraform supports a number of cloud infrastructure providers such as AWS, Azure, GCP, IBM Cloud, OCI, etc. With Terraform, you can package and reuse the code in the form of modules.
Step-by-Step Configuration Pattern
In this article, we will use Terraform to set up an AWS VPC Transit Gateway, enabling seamless connectivity and communication between multiple VPCs within your AWS infrastructure.
The Vpc.tf file in Terraform configures an Amazon VPC in Mumbai, defining CIDR blocks, public and private subnets, an internet gateway for external access, route tables, and routes for internet-bound traffic.
resource "aws_vpc" "WEB_APP_VPC" {
cidr_block = "10.0.0.0/16"
tags = {
Name = "WEB_APP_VPC"
}
}
resource "aws_subnet" "WEB_APP_SUBNET" {
vpc_id =
Step 1 is create provider.tf file with provider and required_providers block.
Step 2 is create Web App VPC in Mumbai Region with CIDR, subnets, internet gateway, route tables.
A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds and on-premises networks. The networking service uses a hub-and-spoke model to connect on-premises data centers and Amazon Virtual Private Clouds to a single gateway.
VPC Attachments, RAM Sharing, and Multi-Account Use
VPC attachments define how a VPC connects to the transit gateway. DNS support and IPv6 support can be enabled per attachment.
A complete module example shows:
module "tgw" {
source = "terraform-aws-modules/transit-gateway/aws"
name = "my-tgw"
description = "My TGW shared with several other AWS accounts"
enable_auto_accept_shared_attachments = true
vpc_attachments = {
vpc = {
vpc_id = "vpc-1234556abcdef"
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
dns_support = true
ipv6_support = true
tgw_routes = [
{
destination_cidr_block = "30.0.0.0/16"
},
{
blackhole = true
destination_cidr_block = "40.0.0.0/20"
}
]
}
}
ram_allow_external_principals = true
ram_principals = [307990089504]
tags = {
Terraform = "true"
Environment = "dev"
}
}
Transit Gateway resources can be shared with different AWS accounts via Resource Access Manager. RAM allows external principals to accept shared attachments automatically.
For comprehensive monitoring of your network infrastructure, check monitoring of bytes transferred and packet drops to catch connectivity issues.
Outputs and Monitoring Considerations
Useful outputs for a transit gateway deployment include:
output "transit_gateway_id" {
value = aws_ec2_transit_gateway.main.id
}
output "transit_gateway_arn" {
value = aws_ec2_transit_gateway.main.arn
}
output "attachment_ids" {
value = {
production = aws_ec2_transit_gateway_vpc_attachment.production.id
staging = aws_ec2_transit_gateway_vpc_attachment.staging.id
shared = aws_ec2_transit_gateway_vpc_attachment.shared.id
}
}
Monitor bytes transferred and packet drops to catch connectivity issues.
For production setups, use custom route tables to enforce network isolation between environments. The hourly cost per attachment adds up across many VPCs, so plan your architecture accordingly.
Conclusion
Transit Gateway simplifies multi-VPC networking dramatically. The key concepts are attachments, how VPCs connect, route tables, which VPCs can reach each other, and propagations, how routes spread automatically.
Terraform provides declarative modules to create transit gateway resources, manage VPC attachments, configure route tables and propagations, and share gateways across accounts with Resource Access Manager. Explicit route table configuration avoids implicit defaults and enforces security boundaries. Hub-and-spoke design centralizes routing, reduces peering complexity, and scales to thousands of VPCs and on-premises networks.
For production setups, use custom route tables to enforce network isolation between environments. Plan attachment costs as hourly cost per attachment adds up across many VPCs. Monitor bytes transferred and packet drops to catch connectivity issues and maintain reliable inter-VPC communication.