Transit Gateway
5 posts tagged Transit Gateway.
Transit Gateway charges whoever sends, so an inspection VPC pays for every gigabyte it did not originate
Data processing is billed per gigabyte sent to the Transit Gateway, to the owner of the attachment that sent it. Route spoke traffic through an inspection VPC and every gigabyte is sent twice: once by the spoke, once by the inspection VPC on the way back. The charge doubles and half of it lands on the central network account. Flexible Cost Allocation exists to move it, with conditions.
Networking8 minSmall transfers work, large ones hang, and the ICMP that would explain it was never sent
Path MTU Discovery depends on the device that drops an oversized packet sending an ICMP back. On AWS, which devices do that is documented per attachment type — and a Site-to-Site VPN is not one of them. Jumbo-frame instances talking to on-premises over a VPN see the classic hang, and no security group rule in the world will produce the ICMP that was never generated.
Networking8 minSecurity group referencing across a Transit Gateway needs two flags, not one
It has to be enabled on the transit gateway and on every VPC attachment. Enable it in one place and it does nothing, with no error. The limitation list is also longer than most people check.
Networking5 minAppliance mode has a prerequisite that silently undoes it
Enable appliance mode and forget route propagation on the associated Transit Gateway route table, and every flow falls back to hash-based Availability Zone selection. The attachment still reports appliance mode enabled.
Networking8 minOne Transit Gateway rule explains both an outage and a security hole
Route lookup happens against the route table associated with the attachment traffic arrived on. That single sentence produces a connection that should work and does not, and a connection that should be impossible and is not.
Networking5 min