All cheat sheets
Networkingcheat sheet

Transit Gateway Peering

Route inter-region AWS traffic over the private backbone at $0.02/GB instead of $0.09/GB public-internet egress — a 77% cut — while replacing an N²-connection VPC-peering mesh with one hub per region.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided Transit Gateway Peering walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Cross-region traffic over the public internet bills ~$0.09/GB; over Transit Gateway peering it rides AWS's private backbone at $0.02/GB — 77% less, plus flat fees of ~$36/month per VPC attachment and per peering link. The second win is topological: 5 VPCs across 2 regions need 10 VPC-peering connections for full mesh, or 2 TGWs and 1 peering link. But TGW is a scale tool — at 1–2 VPCs per region, plain VPC peering (same $0.02/GB, no attachment fees) is cheaper.

The numbers

  • 50 TB/month US↔EU: internet $4,500 vs TGW $1,292 (data + 4 attachments) → **$3,200/month saved**
  • Field examples: a 3-region SaaS moving 80 TB/month went $7,200 → ~$2,140 ($60k/year); a 4-region log-aggregation pipeline at 120 TB/month went $10,800 → ~$3,084 ($92k/year)
  • The honest counter-example: a 2-VPC DR pair at 30 TB/month already on VPC peering ($600) would pay $852 on TGW — attachment fees made it worse; they correctly kept VPC peering

Do this

  1. Find inter-region flows on the public path: Cost Explorer inter-region data-transfer usage types per region pair. Anything meaningful still crossing the internet is the immediate 77% fix.

  2. Build hubs where scale justifies them: TGW per region → attach VPCs → create the peering attachment → update TGW route tables. Traffic never touches the internet.

  3. Peer every pair that must talk. TGW peering is non-transitive: US-East↔EU-West plus EU-West↔AP-Southeast does not connect US-East to AP-Southeast. Book direct flights, not connections.

  4. Re-check the math against plain VPC peering for small topologies — same per-GB rate, zero attachment fees. TGW earns its fees through mesh elimination, not the data rate.

  5. Bonus once the hub exists: centralized inspection (one firewalled VPC on the TGW instead of appliances in every VPC), and the NAT consolidation pattern rides the same hub.

Gotchas

  • Attachment fees are always-on — $36/month per VPC and per peering link, whether you move 100 GB or 100 TB. This is what kills low-volume setups.
  • No transitive routing, no exceptions — plan a direct peering per communicating region pair.
  • Same partition only: no peering into GovCloud or AWS China TGWs.
  • 50 Gbps default ceiling per peering attachment (raisable); single-digit-ms added latency vs direct peering — irrelevant except for ultra-low-latency niches.

Skip this if

  • You're single-region — nothing to peer (bookmark for when DR or data residency forces the issue; retrofitting routing is the painful path).
  • 1–2 VPCs per region with modest traffic — VPC peering is cheaper and simpler.
  • The flows are AWS↔on-prem — that's Direct Connect; many teams run both (DX for hybrid, TGW peering for cross-region).

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account's inter-region connectivity costs. Use
the AWS CLI with READ-ONLY credentials. Do not create, modify, or
delete anything.

1. Map the topology: regions in use; per region aws ec2 describe-vpcs,
   describe-transit-gateways, describe-transit-gateway-attachments
   (note existing peering attachments), and
   describe-vpc-peering-connections (esp. cross-region ones).
2. Find the traffic: Cost Explorer usage types for inter-region
   DataTransfer (e.g., *-DataTransfer-Regional-Bytes / region-to-region
   Out-Bytes) — GB/mo per region pair; note which flows ride public
   internet (no peering/TGW path exists) vs VPC peering vs TGW.
3. Model per region pair, three ways:
   - public internet: GB × ~$0.09
   - VPC peering: GB × $0.02 (cheapest at 1–2 VPCs per region)
   - TGW peering: GB × $0.02 + $36/mo per peering attachment +
     $36/mo per VPC attachment.
   TGW wins vs internet always at volume; vs VPC peering only when
   VPC count makes the mesh (N×(N-1)/2) unmanageable — show both.
4. Non-transitive check: if 3+ regions must all intercommunicate,
   count required direct peering links (every pair).

Report: current topology and flows, per-pair cost now vs modeled
options, a recommendation per pair (including "keep VPC peering" where
that's honest), and the attachment fees included in the math. Change
nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The Transit Gateway Peering walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.