Service comparisons / VPC peering vs Transit Gateway vs PrivateLink
VPC peering vs Transit Gateway vs PrivateLink
VPC peering links two VPCs directly, Transit Gateway is a hub that connects many VPCs and on-premises networks, and PrivateLink exposes a single service privately, even across overlapping IP ranges. How to choose.
Last checked against AWS documentation · How we write our content
| Question | VPC peering | Transit Gateway | PrivateLink |
|---|---|---|---|
| Use it when | A few VPCs need full network access to each other | Many VPCs, accounts, VPNs and Direct Connect need one routed network | Consumers need access to one service, not the whole network |
| Shape | One-to-one connections; not transitive | Hub and spoke; transitive, with route tables to segment traffic | One-way, consumer to provider, through interface endpoints |
| Overlapping IP ranges | Not allowed | Not routable between overlapping VPCs | Works fine |
| Cost | No hourly charge; data transfer only | Per attachment-hour plus per GB processed | Per endpoint-hour plus per GB processed |
| Watch out for | A full mesh of 10 VPCs needs 45 connections | Inter-VPC inspection needs an inspection VPC in the route path | The provider puts the service behind a Network Load Balancer |
All three connect things privately inside AWS without the internet. They differ in how much they connect: a pair of networks, many networks, or a single service.
How to choose
- Two or three VPCs that need to talk, at the lowest cost: VPC peering.
- Dozens of VPCs across accounts, plus on-premises connections, managed in one place: Transit Gateway, shared across the organization with AWS RAM.
- “Offer our service to customers’ VPCs without exposing our network”, or “the VPCs have overlapping CIDR ranges”: PrivateLink.
- Reach AWS services such as S3 or DynamoDB privately: VPC endpoints. Use gateway endpoints for S3 and DynamoDB, and interface endpoints (powered by PrivateLink) for most others.
Exam traps
- Peering is not transitive. If A peers with B and B peers with C, A can’t reach C through B.
- Peering requires non-overlapping CIDR blocks. Overlap points to PrivateLink, or to re-addressing.
- VPC Lattice is the newer option for service-to-service connectivity across VPCs and accounts, with its own auth policies.