ExamFinch.com My Study

Study guide

5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect

Practice this exam

AWS Solutions Architect Associate SAA-C03

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Solutions Architect Associate (SAA-C03) Exam Study Strategies and Exam Tips for SAA-C03 The AWS Well-Architected Framework

2 Domain 1: Design Secure Architectures (30%)

1.1 IAM Fundamentals — Users, Groups, Roles, and Policies 1.2 AWS Organizations, SCPs, and Multi-Account Strategy 1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints 1.4 Encryption, KMS, and Secrets Management 1.5 AWS WAF, Shield, and Network Firewall 1.6 GuardDuty, Inspector, Macie, and Security Hub 1.7 The Shared Responsibility Model for Solutions Architects 1.8 Data Protection, Compliance, and Audit Services

3 Domain 2: Design Resilient Architectures (26%)

2.1 Elastic Load Balancing (ELB) — ALB, NLB, and GWLB 2.2 EC2 Auto Scaling — Dynamic, Predictive, and Scheduled 2.3 Multi-AZ and Multi-Region Architectures 2.4 Disaster Recovery Strategies — RTO and RPO 2.5 Decoupling with SQS, SNS, and EventBridge 2.6 AWS Step Functions and Workflow Orchestration

4 Domain 3: Design High-Performing Architectures (24%)

3.1 EC2 Instance Types, Purchasing Options, and Placement Groups 3.2 Lambda, Serverless Compute, and Container Services 3.3 Amazon S3 - Storage Classes, Lifecycle, and Performance 3.4 Block and File Storage - EBS, EFS, and FSx 3.5 Database Services - RDS, Aurora, DynamoDB, and More 3.6 CloudFront, Route 53, and Global Accelerator 3.7 Data Ingestion and Transformation - Kinesis, Glue, and EMR

5 Domain 4: Design Cost-Optimized Architectures (20%)

4.1 Compute Cost Optimization — Right-Sizing, RIs, Savings Plans, and Spot 4.2 Storage Cost Optimization — S3 Tiers, EBS, and Data Transfer 4.3 Database Cost Optimization 4.4 AWS Cost Management and Monitoring Tools

6 VPC and Networking Deep Dive

5.1 VPC Architecture — Subnets, Route Tables, and Gateways 5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect 5.3 Amazon API Gateway 5.4 CloudFormation and Infrastructure as Code 5.5 AWS PrivateLink and Endpoint Services

7 Migration, Transfer, and Hybrid Services

6.1 The 7 Rs of Cloud Migration 6.2 AWS Snow Family — Snowball Edge Devices 6.3 CloudWatch, CloudTrail, and AWS Config 6.4 Amazon Cognito and Identity Federation 6.5 AWS DataSync and Transfer Family

8 Serverless Architecture and Application Services

7.1 Serverless Architecture Patterns 7.2 Advanced SQS Patterns — DLQ, Backpressure, and FIFO 7.3 Analytics Services — Athena, OpenSearch, and QuickSight 7.4 Container Orchestration — ECS, EKS, and ECR

9 Advanced Topics and Exam Scenarios

8.1 Advanced IAM — Permission Boundaries, Federation, and Cross-Account 8.2 Caching Strategies and ElastiCache Patterns 8.3 Hybrid Architecture — DNS, Storage, and Compute 8.4 SAA-C03 Scenario Practice — Putting It All Together

5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect

Key Takeaways Explain This Topic AI

VPC peering is private and has no bandwidth limit, but it is NOT transitive — n VPCs needing full mesh require n*(n-1)/2 connections.

Transit Gateway is a transitive hub-and-spoke router connecting thousands of VPCs and on-premises networks, shared cross-account via AWS Resource Access Manager.

Direct Connect is a dedicated physical link (1/10/100 Gbps) with consistent latency but is NOT encrypted by default — layer a VPN on top for encryption.

Site-to-Site VPN is an IPsec tunnel over the public internet, set up in minutes, with two tunnels per connection and up to 1.25 Gbps per tunnel.

Direct Connect provisioning takes weeks to months because it requires a physical cross-connect at an AWS Direct Connect location.

Last updated: June 2026

Quick Answer: VPC peering = simple, private, unlimited-bandwidth VPC-to-VPC link, but not transitive . Transit Gateway = transitive hub connecting thousands of VPCs and on-premises, with segmented route tables. Direct Connect = dedicated physical link (1/10/100 Gbps), consistent latency, not encrypted by default. Site-to-Site VPN = IPsec over the internet, minutes to set up, variable latency.

VPC Peering

VPC peering creates a private connection between two VPCs (same or cross-Region, same or cross-account). Traffic stays on the AWS backbone and there is no bandwidth bottleneck.

The defining limitation is that peering is non-transitive : if A↔B and B↔C are peered, A still cannot reach C through B. CIDR blocks must not overlap. Full mesh scales quadratically — the formula n (n-1)/2 * is worth memorizing:

  • VPCs Peering connections for full mesh
  • 3 3
  • 5 10
  • 10 45
  • 20 190

That explosion is exactly why the exam steers larger topologies toward Transit Gateway.

Transit Gateway, Direct Connect, and Site-to-Site VPN

AWS Transit Gateway (TGW) is a regional hub-and-spoke router. Every VPC, VPN, and Direct Connect gateway attaches once, and TGW provides transitive routing among them. Multiple TGW route tables let you segment environments (for example, isolate dev from prod). Share a TGW across accounts with AWS Resource Access Manager (RAM) ; connect Regions with TGW peering . Each attachment supports up to ~50 Gbps.

AWS Direct Connect (DX) is a dedicated, private fiber link from your data center into an AWS Direct Connect location, available at 1, 10, or 100 Gbps (sub-1 Gbps via hosted-connection partners). It delivers consistent, predictable latency but is not encrypted — wrap a Site-to-Site VPN over the DX link when encryption is required. Provisioning takes weeks to months (physical cross-connect), and a single link is a single point of failure, so resilient designs use two links.

AWS Site-to-Site VPN establishes an IPsec tunnel over the public internet in minutes. Each connection provides two tunnels (for HA) at up to 1.25 Gbps each, with variable latency tied to internet routing.

  • Feature VPC Peering Transit Gateway Direct Connect Site-to-Site VPN
  • Topology 1:1 Hub-and-spoke Dedicated link IPsec over internet
  • Transitive No Yes N/A N/A
  • Bandwidth Unlimited ~50 Gbps/attach 1–100 Gbps 1.25 Gbps/tunnel
  • Setup time Minutes Minutes Weeks–months Minutes
  • Encrypted Private (backbone) Private (backbone) No (add VPN) Yes (IPsec)

On the Exam: "50 VPCs plus on-premises with centralized routing" → Transit Gateway. "Dedicated link, consistent low latency, hybrid analytics" → Direct Connect. "Encrypted connection to AWS today" → Site-to-Site VPN. "Lowest-latency hybrid link that is also encrypted" → Direct Connect with a VPN on top.

Hybrid Resilience and Failover Patterns

The exam frequently layers connectivity options for high availability, so know the standard combinations.

DX primary, VPN backup: run Direct Connect for steady-state performance and configure a Site-to-Site VPN as a failover path. If the DX link drops, BGP reconverges to the VPN. This is the canonical "cost-effective resilience" answer.

Dual Direct Connect: for the highest resilience, provision two DX links at two different Direct Connect locations. AWS's highest-resilience model uses connections terminating on separate devices in separate locations.

Transit Gateway as the hybrid hub: attach a Direct Connect Gateway and VPN to a Transit Gateway so every spoke VPC reaches on-premises without per-VPC links.

Migration and Bandwidth Decision Aids

When a question asks how to move large data volumes, distinguish the connection from the transfer tool. For ongoing low-latency access, choose DX. For a one-time bulk migration of terabytes-to-petabytes, AWS Snowball/Snow Family is often cheaper and faster than saturating a network link for weeks.

  • Requirement signal Correct choice
  • "Consistent latency, hybrid, ongoing" Direct Connect
  • "Encrypted, set up in minutes" Site-to-Site VPN
  • "Connect dozens of VPCs + on-prem" Transit Gateway
  • "Two VPCs, simplest possible" VPC peering
  • "Petabytes once, link too slow" Snow Family (offline)
  • "DX but must be encrypted" VPN over Direct Connect

A recurring trap: candidates pick Direct Connect for a "connect today / urgent" scenario. Direct Connect requires a physical cross-connect and takes weeks to months to provision — so an urgent encrypted link is always Site-to-Site VPN, even if DX is the long-term goal. Another trap is assuming peering or DX is encrypted; only VPN provides encryption out of the box, while peering and DX keep traffic private on the AWS backbone but unencrypted.

Routing Glue and Gateways

Two gateway objects tie hybrid routing together and are easy to confuse. A Virtual Private Gateway (VGW) is the VPC-side endpoint for a single VPC's VPN or DX connection — fine for one or two VPCs. A Direct Connect Gateway is a global object that lets one Direct Connect connection reach VPCs in multiple Regions and attach to Transit Gateways, which is why large hybrid designs pair Direct Connect Gateway with Transit Gateway rather than a per-VPC VGW. Routing across all of these is exchanged dynamically with BGP , so failover between a DX primary and VPN backup is automatic once both advertise the same prefixes.

Remember that Transit Gateway, like a VPC, cannot route between attachments whose CIDRs overlap, so non-overlapping address planning remains mandatory even with a transitive hub.