Every AWS architect eventually hits the same wall: three VPCs need to talk to each other, or a hundred do, and suddenly “just peer them” stops being an answer. AWS gives you three distinct ways to connect networks inside its cloud — VPC Peering, Transit Gateway, and PrivateLink — and picking the wrong one shows up on the bill within a month. As of August 2026, AWS prices Transit Gateway attachments at $0.05 per hour plus $0.02 per GB processed in US East, while VPC Peering stays free inside a single Availability Zone and PrivateLink interface endpoints run about $0.01 per hour plus per-GB processing charges — though the baseline shifts by Region: AWS’s EU rate card set Transit Gateway at 0.118423 EUR per hour as of July 2026, and its Japan pricing listed a separate 0.10 USD per hour rate plus a 0.05 USD per-VPC-attachment charge as of April 2026. Those numbers sound small until you multiply them across dozens of VPCs and terabytes of monthly traffic.
This comparison breaks down what each service actually does, what it costs at scale, how fast it moves data, and which one fits your architecture — whether you’re connecting three VPCs in one account or building a hub for 500 spoke networks across a multi-account organization.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
AWS Transit Gateway vs VPC Peering vs PrivateLink: The Core Difference
The three services solve different connectivity problems, and that’s the first thing most comparison guides skip past. VPC Peering is a direct, one-to-one network connection between two VPCs — it routes traffic at Layer 3 as if the two VPCs were one flat network, with no intermediary hop. AWS’s own documentation frames it plainly: a peering connection “puts an end to complex peering relationships” once you outgrow it, which is really an admission that peering was never built for scale (AWS Transit Gateway product page).
AWS Transit Gateway is the opposite model: a fully managed hub that every VPC, VPN, and Direct Connect circuit attaches to, so you get one central routing point instead of a mesh of point-to-point links. AWS describes it as providing “a hub and spoke design for connecting VPCs and on-premises networks as a fully managed service without requiring you to provision third-party virtual appliances” (AWS multi-VPC network infrastructure whitepaper). The hub got wider on June 16, 2025, when AWS shipped Network Function Attachments, letting a Transit Gateway connect directly to AWS Network Firewall so inline traffic inspection sits on the same hub as the VPC, VPN, and Direct Connect attachments instead of requiring a separate inspection-VPC design.
AWS PrivateLink is neither of those — it’s not really network transit at all. It exposes a specific service (yours or AWS’s) to consumers in other VPCs through an interface endpoint, without giving those consumers any visibility into your VPC’s CIDR range or routing tables. AWS defines it as connectivity that “provides private connectivity between VPCs, AWS services, and your on-premises networks without exposing your traffic to the public internet” (AWS whitepaper). If Transit Gateway is a highway interchange, PrivateLink is a single doorbell — you reach one service, not the whole building.
Confusingly, these three services are frequently combined rather than chosen exclusively. AWS’s networking blog notes that “to share a VPC endpoint with other VPCs they will need layer-three connectivity through a transit gateway or VPC peering,” meaning PrivateLink endpoints in a shared-services VPC often still ride on top of a Transit Gateway or peering connection for the VPCs that consume them (AWS Transit Gateway + PrivateLink + Route 53 Resolver integration guide).
Full Specs Comparison: Transit Gateway vs VPC Peering vs PrivateLink
Here’s the side-by-side breakdown covering architecture, cost structure, and operational limits as of August 2026.
| Spec | VPC Peering | Transit Gateway | PrivateLink |
|---|---|---|---|
| Connection model | Point-to-point, VPC-to-VPC | Hub-and-spoke, many-to-many | Consumer-to-service, one-directional |
| Layer | Layer 3 (IP routing) | Layer 3 (IP routing) | Layer 4/7 (service endpoint via NLB/GWLB) |
| Setup cost | $0 (connection itself is free) | $0 (pay per attachment) | $0 (pay per endpoint) |
| Hourly cost | $0 | $0.05/hour per attachment | ~$0.01/hour per interface endpoint (~$7.30/month) |
| Same-AZ data transfer | Free | $0.02/GB processed | ~$0.01/GB processed |
| Cross-AZ data transfer | $0.01/GB each direction | $0.02/GB processed | ~$0.01/GB processed |
| Cross-Region data transfer | ~$0.02/GB each direction | Requires TGW peering + standard inter-Region rates | Requires separate endpoint per Region |
| Max bandwidth per attachment | No explicit cap (VPC throughput limits apply) | Up to 100 Gbps per AZ per VPC attachment | Scales with ENI/NLB targets, no single flat cap published |
| Transitive routing | Not supported (no hairpinning through a peered VPC) | Native — any attachment can reach any other | Not applicable (service-to-consumer only) |
| Third-party appliances required | No | No | No |
| Best for scale | A handful of VPCs (mesh gets unmanageable fast) | Dozens to thousands of VPCs and on-prem links | Any number of consumer VPCs reaching one service |
| Exposes consumer CIDR to provider | Yes, mutually | Yes, across the hub | No — full network isolation between consumer and provider |
| On-premises connectivity | Not directly (needs a gateway) | Yes, via Direct Connect or Site-to-Site VPN attachments | Yes, via VPC endpoint services reachable from on-prem |
| Central management console | No — managed per pairing | Yes — single route table view across attachments | No — managed per endpoint/endpoint service |
Source: Amazon VPC Pricing, AWS Transit Gateway Pricing, and multiple 2026 AWS cost breakdowns. Data processing charges do not apply to traffic sent from a Transit Gateway peering attachment to another Transit Gateway — only the originating attachment side pays.
Pricing Breakdown: What Each Option Actually Costs
Data transfer pricing is where these three services diverge the most, and it’s the number that actually shows up on your monthly invoice. Below is the pricing table for the US East (N. Virginia) Region, which AWS uses as its baseline for most published rate cards; AWS’s published pricing as of September 2026 still lists Transit Gateway attachment charges at $0.05 per hour and data processing at $0.02 per GB, and AWS’s US East (Ohio) rate card, dated August 2026, charges the identical $0.05 per hour per Transit Gateway attachment, so the figures below hold consistently across both US East Regions.
| Charge type | VPC Peering | Transit Gateway | PrivateLink |
|---|---|---|---|
| Connection/attachment creation | Free | Free to create; billed hourly once active | Free to create; billed hourly once active |
| Hourly attachment/endpoint fee | $0 | $0.05/hour per attachment | ~$0.01/hour per interface endpoint |
| Same-AZ data | $0/GB | $0.02/GB processed | ~$0.01/GB processed |
| Cross-AZ, same Region data | $0.01/GB each direction | $0.02/GB processed | ~$0.01/GB processed |
| Cross-Region data | ~$0.02/GB each direction | Standard inter-Region transfer + TGW peering hourly fee | Separate endpoint per Region required |
| Monthly cost: 3 VPCs, 1TB cross-AZ traffic | ~$10 (data only, mesh of 3 peering links) | ~$130 (3 attachments x $0.05/hr x 730hrs + $0.02/GB x 1,000GB) | ~$39 (4 endpoints x $7.30 + $0.01/GB x 1,000GB) |
| Monthly cost: 50 VPCs, 10TB traffic | Impractical — 1,225 peering connections needed for full mesh | ~$2,025 (50 attachments x $36.50 + $0.02/GB x 10,000GB) | Depends entirely on number of services exposed, not VPC count |
The 50-VPC row is the one that changes decisions. A full mesh of VPC Peering connections across 50 VPCs requires n(n-1)/2 links — 1,225 individual peering connections, each with its own route table entries, security group rules, and DNS resolution config. Nobody runs that in production. Transit Gateway collapses it to 50 attachments and one route table, which is exactly why AWS positions it as the tool for large-scale, multi-VPC, multi-account, hybrid topologies with centralized routing and strong operational control. Third-party cost tooling backs this up: Cloudburn’s Transit Gateway calculator, updated in August 2026, still pegs the math at $0.05/hour (roughly $36.50/month) per attachment plus $0.02/GB, confirming the per-attachment pricing hasn’t drifted even as usage scales. PrivateLink doesn’t scale by VPC count at all — its cost scales with the number of services you expose and the endpoints consumers create to reach them, which makes it the cheapest option when you’re publishing a handful of APIs to hundreds of consumer accounts rather than connecting flat networks. Splitting that Transit Gateway bill across teams also got easier in November 2025, when AWS introduced Flexible Cost Allocation, letting organizations allocate data processing costs among the sending account, the receiving account, or the account that owns the hub, instead of the hub owner absorbing every attachment’s traffic charges by default.
One AWS-documented real-world cost example comes from SAP RISE deployments on AWS, where Transit Gateway peering attachments connect multi-Region SAP landscapes. AWS’s own SAP guide walks through a worked example: “100GB * $0.02 per GB = $2 (Transit Gateway data processing),” part of a total billed range of “$3–$15.8” for that specific peering scenario, illustrating how quickly the per-GB data processing fee adds up even before hourly attachment charges are counted (AWS SAP RISE Transit Gateway connection guide). AWS’s broader Transit Gateway guidance, updated April 2026, runs a similar worked example outside the SAP context: two VPC attachments alone accumulate $72.00 in hourly charges over a month, moving 1GB of data between those two VPCs adds $0.60 in data processing at the confirmed $0.02/GB rate, and sending that same 1GB between two inter-Region peered Transit Gateways costs $0.40 — three separate line items that stack on top of each other on a real invoice.
Performance and Latency: Which One Is Actually Faster
Latency differences between these three services are small in absolute terms but matter for chatty, latency-sensitive workloads like database replication or synchronous microservice calls.
VPC Peering carries the least overhead. Because it’s direct IP routing between two VPCs with no intermediary appliance or hop, it delivers what networking guides describe as effectively native in-VPC latency — the packet path is the shortest of the three options. That makes it the right call for tightly coupled services that exchange large volumes of data with strict latency budgets, as long as you’re only connecting a small number of VPCs.
Transit Gateway adds a small, measurable hop. Traffic passes through the centralized TGW for encapsulation and processing before reaching its destination attachment, which introduces marginally higher latency than direct peering. In practice this overhead is negligible for the vast majority of workloads — the trade-off is centralized routing and massive scale in exchange for a few extra microseconds per hop, not a meaningful performance penalty for anything short of ultra-low-latency trading systems or real-time gaming backends.
PrivateLink sits between the two for a single consumer-provider path, since traffic still traverses a Network Load Balancer or Gateway Load Balancer on the provider side. For service-style access patterns — one consumer calling one published API — that overhead is close to normal in-VPC ENI traffic and is rarely the bottleneck. Where PrivateLink actually wins is throughput scaling: because capacity is added by scaling the underlying NLB and target group rather than a single fixed pipe, high-fan-out SaaS architectures can grow consumer count without redesigning the network layer.
On raw bandwidth, Transit Gateway publishes a hard ceiling: up to 100 Gbps per Availability Zone per VPC attachment, according to AWS’s own Transit Gateway deep-dive material. VPC Peering has no separately published bandwidth cap — it’s bound by whatever the underlying VPC and instance networking limits allow, which for large instance types can exceed what a single TGW attachment delivers. PrivateLink throughput isn’t expressed as a single number at all; it scales horizontally with the number of NLB targets and ENIs behind the endpoint, so a poorly-provisioned target group — not the PrivateLink service itself — is usually the actual bottleneck teams hit.
Recent Updates: What Changed on Each Service in 2026
AWS has been shipping incremental improvements to its networking stack throughout 2026, with most of the visible activity landing on Transit Gateway and EKS Auto Mode’s use of it.
- July 22, 2026 — Amazon EKS added support for EC2 placement groups and Elastic Fabric Adapter (EFA) network interfaces on node pools using EKS Auto Mode and Karpenter, letting distributed training and inference workloads configure cluster, spread, or partition placement strategies directly through node provisioning.
- July 28, 2026 — EKS added AWS PrivateLink support for the cluster OIDC discovery/JWKS endpoint, allowing IAM Roles for Service Accounts (IRSA) to reach the identity endpoint privately from inside a VPC without internet egress — a direct example of PrivateLink solving a problem Transit Gateway and peering can’t.
- July 1, 2026 — EKS Auto Mode cut GPU management fees: G-series management fees dropped 35%, and G‑series Auto Mode management fees dropped 35% while P‑series plus AWS Trainium fees dropped 60%, changing the cost calculus for teams running GPU clusters.
- June 18, 2026 — EKS introduced customer-routed control plane egress via a new controlPlaneEgressMode=CUSTOMER_ROUTED setting, giving teams direct control over how control-plane traffic routes through their Transit Gateway or VPC topology.
- June 23, 2026 — AWS shipped EKS Auto Mode networking optimizations that cut node boot time by 39% (about 13 seconds faster) and made node scale-out 43% faster, with consolidation up to 69% faster and 30% more usable cluster capacity — all of which interact directly with how fast new Transit Gateway attachments and route propagations take effect.
Notably, AWS’s own August 2026 documentation did not surface headline feature announcements specific to VPC Peering or core PrivateLink functionality in the same window — both services are mature, stable primitives that AWS iterates on more quietly than the newer Auto Mode and Karpenter-driven EKS networking stack. That stability is itself a data point: teams choosing Peering or PrivateLink today are choosing tools whose behavior isn’t likely to shift under them, while Transit Gateway is where AWS is actively investing new capability.
What AWS Documentation Says About Each Service
Rather than paraphrase AWS’s own positioning, it’s worth quoting the source material directly, since AWS’s product pages and whitepapers are unusually explicit about when each service is meant to be used.
“AWS Transit Gateway connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub.”
AWS Transit Gateway, Amazon Web Services — aws.amazon.com/transit-gateway
“This connection simplifies your network and puts an end to complex peering relationships.”
AWS Transit Gateway, Amazon Web Services — aws.amazon.com/transit-gateway
“To share a VPC endpoint with other VPCs they will need layer-three connectivity through a transit gateway or VPC peering.”
AWS Networking Blog, Amazon Web Services — aws.amazon.com/blogs/networking-and-content-delivery
“AWS Transit Gateway provides a hub and spoke design for connecting VPCs and on-premises networks as a fully managed service without requiring you to provision third-party virtual appliances.”
AWS Documentation, Amazon Web Services — docs.aws.amazon.com whitepapers
“AWS PrivateLink provides private connectivity between VPCs, AWS services, and your on-premises networks without exposing your traffic to the public internet.”
AWS Documentation, Amazon Web Services — docs.aws.amazon.com whitepapers
Read together, these five statements map cleanly onto the three architecture patterns this article covers: Transit Gateway for hub-and-spoke consolidation, VPC Peering and Transit Gateway both providing the layer-three transport that PrivateLink deliberately avoids, and PrivateLink existing specifically to keep traffic off the public internet while skipping full network-level connectivity altogether.
CLI and Terraform Examples for Each Connection Type
Seeing the actual resource definitions side by side makes the architectural difference concrete. Here’s the minimal AWS CLI syntax to stand up each connection type.
VPC Peering — create the connection, then accept it from the peer account:
aws ec2 create-vpc-peering-connection
--vpc-id vpc-0aaa11112222bbbbb
--peer-vpc-id vpc-0ccc33334444dddde
--peer-region us-east-1
aws ec2 accept-vpc-peering-connection
--vpc-peering-connection-id pcx-0123456789abcdef0
aws ec2 create-route
--route-table-id rtb-0aaa1111
--destination-cidr-block 10.1.0.0/16
--vpc-peering-connection-id pcx-0123456789abcdef0Transit Gateway — create the hub, then attach each VPC to it:
aws ec2 create-transit-gateway
--description "Central hub for prod VPCs"
--options AmazonSideAsn=64512,AutoAcceptSharedAttachments=disable
aws ec2 create-transit-gateway-vpc-attachment
--transit-gateway-id tgw-0123456789abcdef0
--vpc-id vpc-0aaa11112222bbbbb
--subnet-ids subnet-0aaa1111 subnet-0bbb2222
aws ec2 create-route
--route-table-id rtb-0aaa1111
--destination-cidr-block 10.0.0.0/8
--transit-gateway-id tgw-0123456789abcdef0PrivateLink — publish a VPC endpoint service on the provider side, then create a consumer interface endpoint:
# Provider side: publish the service behind an NLB
aws ec2 create-vpc-endpoint-service-configuration
--network-load-balancer-arns arn:aws:elasticloadbalancing:us-east-1:111122223333:loadbalancer/net/billing-nlb/abc123
--acceptance-required
# Consumer side: create the interface endpoint
aws ec2 create-vpc-endpoint
--vpc-id vpc-0ccc33334444dddde
--service-name com.amazonaws.vpce.us-east-1.vpce-svc-0123456789abcdef0
--vpc-endpoint-type Interface
--subnet-ids subnet-0ccc3333The structural difference is visible in the API calls themselves: VPC Peering and Transit Gateway both modify route tables directly, because both operate at the IP routing layer. PrivateLink never touches a route table at all — it registers a DNS-resolvable endpoint instead, which is the mechanical reason it can’t be used as a general substitute for the other two.
Security and Compliance: Which Option Passes an Audit
Security reviewers evaluate these three services differently, and the distinction usually comes down to blast radius. VPC Peering and Transit Gateway both grant IP-level reachability into the connected network, scoped only by route tables, security groups, and network ACLs. If a security group rule is too permissive, or a route table pushes a broader CIDR block than intended, a peered or Transit Gateway-attached VPC can reach more of your network than the architecture diagram suggests. This is why network segmentation reviews for peering and Transit Gateway topologies focus heavily on route table audits — the connectivity layer itself doesn’t enforce scope, the configuration on top of it does.
PrivateLink flips that model. Because a consumer’s interface endpoint only ever resolves to the specific service published by the provider — never the provider’s broader subnet or CIDR range — the blast radius of a misconfiguration is contained to that one service by design, not by an administrator remembering to scope a route table correctly. This is the property that makes PrivateLink the default recommendation for PCI-DSS, HIPAA, and SOC 2 environments where auditors want to see that a compromised consumer account cannot pivot into the provider’s broader network, even in the worst case.
That said, PrivateLink isn’t automatically more compliant — it just removes one category of risk. Interface endpoints still need endpoint policies restricting which IAM principals can use them, and provider-side NLB target groups still need their own security group rules. Transit Gateway, for its part, supports its own route table segmentation (multiple route tables per Transit Gateway, not just one shared table), which lets security teams recreate some of PrivateLink’s isolation properties within a hub-and-spoke model — at the cost of significantly more configuration overhead than PrivateLink’s default-isolated posture.
For encryption, all three transport data over AWS’s internal network backbone rather than the public internet by default, but that picture changed for Transit Gateway in November 2025, when AWS launched Transit Gateway Encryption Support, enforcing encryption in transit for all traffic crossing the hub without the application having to handle it — VPC Peering and PrivateLink still leave that responsibility to the application (TLS), so Transit Gateway is now the only one of the three with network-layer encryption built in by default. Auditors generally treat “stays off the public internet” as satisfied by all three, but only PrivateLink satisfies the stricter “consumer cannot enumerate the provider’s network” requirement that shows up in stricter multi-tenant compliance frameworks.
Monitoring and Troubleshooting Each Connection Type
Each service surfaces different signals when something breaks, and knowing which console or log to check first saves real debugging time.
VPC Peering issues almost always trace back to route tables or security groups rather than the peering connection itself — once a peering connection reaches the “active” state, it rarely fails on its own. VPC Flow Logs on both sides of the connection are the fastest way to confirm whether traffic is actually leaving one VPC and arriving at the other, or getting silently dropped by a missing route.
Transit Gateway ships its own flow log integration and a Network Manager dashboard that visualizes attachment health, route propagation, and cross-attachment traffic volume in one place — a meaningful operational advantage over stitching together flow logs from a dozen individual peering connections. When troubleshooting Transit Gateway routing, the first checks are always the same: is the attachment actually associated with the expected route table, and has the route actually propagated (auto-propagation is opt-in per route table, not automatic by default).
PrivateLink failures typically show up as DNS resolution problems rather than routing problems, since consumers reach the service through a DNS name that resolves to the interface endpoint’s ENI. The most common issue is private DNS not being enabled on the consumer endpoint, which causes lookups to resolve to the public service name instead of the private endpoint — traffic then either fails outright or unexpectedly routes over the internet gateway path instead of staying private. CloudWatch metrics on the endpoint (bytes processed, active connections) and the provider-side NLB’s target health checks are the two places to look when a published service seems unreachable.
5 Real-World Architecture Patterns
These are the architecture patterns cloud teams actually run in production, based on how AWS documents each service’s intended use.
1. Multi-account SaaS platform exposing a shared API
A SaaS vendor running one production VPC needs to expose a billing API to 200 customer AWS accounts without ever seeing those customers’ internal network layouts, and without those customers seeing the vendor’s backend CIDR ranges. PrivateLink is the only one of the three that fits: the vendor creates one VPC endpoint service backed by a Network Load Balancer, and each customer creates a consumer endpoint in their own VPC. No peering connections, no shared route tables, and the vendor can rotate their entire backend without customers noticing.
2. Global enterprise connecting 80 regional VPCs to a shared services hub
A multinational running separate VPCs per business unit and Region needs all 80 to reach a central shared-services VPC (DNS, logging, security tooling) and to reach each other for cross-team data flows. This is the textbook Transit Gateway case: one hub, 80 spoke attachments, and centralized route tables instead of the roughly 3,160 point-to-point peering connections a full mesh would require. AWS explicitly designed Transit Gateway to replace exactly this kind of sprawl.
3. SAP RISE landscape spanning two AWS Regions
AWS’s own SAP RISE documentation describes production SAP landscapes using inter-Region Transit Gateway peering to connect application and database tiers across Regions, with each Transit Gateway owner billed hourly for their side of the peering attachment plus per-GB data processing. This is a documented AWS reference architecture, not a hypothetical — it’s how AWS recommends connecting managed SAP environments that span Regions for disaster recovery.
4. Two-VPC dev/staging environment with a single tight integration
A small engineering team runs a staging VPC that needs direct, high-throughput, low-latency access to a shared data lake VPC for nightly batch jobs, and nothing else. Standing up a Transit Gateway for two VPCs means paying $0.05/hour per attachment plus $0.02/GB for a connection that a free, same-AZ VPC Peering link handles identically at zero data cost. This is the most common over-engineering mistake teams make — reaching for Transit Gateway by default when a simple peering connection between two VPCs is both cheaper and marginally faster.
5. Financial services firm isolating a compliance-scoped payments VPC
A payments team needs application VPCs across the company to call a PCI-scoped payments-processing service without those application VPCs ever having network-level reachability into the payments VPC itself — auditors specifically want to see that isolation. PrivateLink again fits precisely: consumers get DNS-resolvable access to the payment API through an interface endpoint, while the payments VPC’s subnets, security groups, and CIDR block stay completely invisible to every consumer, satisfying network segmentation requirements that Transit Gateway’s shared route table model would undermine.
Migration Guide: Moving From VPC Peering to Transit Gateway
Teams that started with a small peering mesh and outgrew it follow a fairly consistent migration path. Here’s the sequence that avoids downtime.
- Audit existing peering connections. List every active VPC Peering connection, its route table entries, and the security groups referencing peered CIDR ranges. This inventory becomes your Transit Gateway attachment list.
- Stand up the Transit Gateway in parallel. Create the Transit Gateway and attach it to each VPC without removing existing peering connections yet — the two connectivity paths can coexist during migration.
- Update route tables incrementally, VPC by VPC. Add routes pointing relevant CIDR ranges to the new Transit Gateway attachment, but leave the old peering route as a fallback for the first VPC you migrate. Confirm traffic actually shifts (check flow logs or Transit Gateway’s own flow log integration) before touching the next VPC.
- Validate transitive routing behavior. This is the step teams miss: VPC Peering never allowed transitive routing (VPC A can’t reach VPC C through VPC B), but Transit Gateway does by default. Audit your new route tables for unintended transitive paths that weren’t possible under the old peering mesh — this is a common source of accidental over-permissive access after migration.
- Remove old peering routes, then delete the peering connections. Only after traffic has run cleanly over Transit Gateway for a full billing cycle (to catch any missed edge-case routes) should you delete the underlying VPC Peering connections.
- Re-point security groups and NACLs if they reference peering-specific CIDR blocks. Most security group rules reference CIDR ranges rather than the peering connection ID directly, so this step is often a no-op — but verify it explicitly rather than assuming.
- Monitor the data processing cost delta for one full month. Transit Gateway’s $0.02/GB processing charge applies where VPC Peering’s equivalent same-AZ traffic was free. Budget for this before migrating, not after the first invoice arrives.
The reverse migration — Transit Gateway back down to peering — is rare in practice, since teams that adopted Transit Gateway almost always did so because they’d already outgrown a peering mesh. The exception is cost optimization: some teams selectively pull a handful of high-traffic, two-VPC connections back out to direct peering once they realize a specific pair of VPCs is generating disproportionate Transit Gateway data processing charges for traffic that doesn’t need the hub’s transitive routing at all.
Pros and Cons of Each Option
VPC Peering
Pros: Free same-AZ data transfer, lowest latency of the three, no hourly attachment fee, simplest mental model, no additional managed service to monitor.
Cons: No transitive routing, mesh complexity grows quadratically past a handful of VPCs, no central route table view, each connection needs individually maintained route entries and security group rules, exposes both VPCs’ CIDR ranges to each other.
Transit Gateway
Pros: Scales to thousands of attachments, native transitive routing, single centralized route table, handles VPN and Direct Connect attachments alongside VPCs, purpose-built for hybrid and multi-account topologies, up to 100 Gbps per AZ per attachment.
Cons: $0.05/hour per attachment adds up across many VPCs, $0.02/GB data processing charge applies even to same-AZ traffic (unlike free peering), slightly higher latency than direct peering, transitive routing can create unintended access paths if route tables aren’t carefully scoped.
PrivateLink
Pros: Strongest network isolation of the three (no CIDR exposure either direction), scales by service rather than by VPC count, ideal for SaaS and multi-tenant architectures, works across accounts and Regions without a shared routing layer, lowest hourly cost per connection point.
Cons: Only works for defined service endpoints, not general IP connectivity — you can’t use it to let two VPCs talk to each other freely, throughput depends on how well the provider scales their NLB targets, requires a separate endpoint per Region for multi-Region services, doesn’t replace Transit Gateway or peering for general network transit.
5+ Use-Case Recommendations
- Connecting 2-5 VPCs with heavy, latency-sensitive traffic → VPC Peering. Free same-AZ transfer and the lowest latency path make it the right default at small scale.
- Multi-account landing zone with dozens to hundreds of VPCs → Transit Gateway. The centralized route table and per-attachment billing model scale linearly instead of quadratically.
- Publishing an internal or external API to many consumer accounts → PrivateLink. Isolation and per-service billing beat network-level connectivity for this pattern every time.
- Hybrid cloud with on-premises data centers via Direct Connect or VPN → Transit Gateway. It’s the only one of the three built to attach VPN and Direct Connect gateways alongside VPCs in one hub.
- Regulated industries needing auditable network segmentation (finance, healthcare) → PrivateLink for cross-team service access, keeping application VPCs invisible to each other at the network layer.
- Disaster recovery landscape spanning two Regions → Transit Gateway with inter-Region peering, following the pattern AWS documents for SAP RISE deployments.
- Cost-sensitive startup connecting a staging and production VPC → VPC Peering. Skip the $0.05/hour Transit Gateway attachment fee until you actually have more than a handful of VPCs to connect.
Common Mistakes Teams Make Choosing Between Them
The most expensive mistake is defaulting to Transit Gateway for everything because it’s the “enterprise” answer. Teams that stand up a Transit Gateway for two or three VPCs end up paying $0.05/hour per attachment and $0.02/GB in processing charges for traffic that would have crossed a free, same-AZ VPC Peering link at zero cost. Transit Gateway earns its price tag once you’re managing double-digit VPC counts or need hybrid connectivity — below that, it’s usually the more expensive and marginally slower option for no functional gain.
The second common mistake runs the other direction: trying to force PrivateLink to do general network connectivity. PrivateLink connects consumers to a specific published service — it was never meant to replace VPC-to-VPC IP routing, and teams that try to route general application traffic through interface endpoints end up building a maze of endpoints per service instead of just using Transit Gateway or peering for that traffic pattern.
The third mistake is under-scoping Transit Gateway route tables after migration. Because Transit Gateway supports transitive routing by default, teams that migrate off a peering mesh — where transitive routing was never possible — sometimes inherit accidental reachability between VPCs that were never meant to talk to each other. This is worth an explicit route table audit, not an assumption that old peering-era isolation carried over automatically.
The Verdict: Which One Should You Actually Use
There isn’t a single winner here because the three services aren’t really competing for the same job. Based on the pricing and architecture data above, the decision comes down to three questions: how many VPCs are you connecting, do you need transitive routing, and are you exposing a service or a whole network.
Choose VPC Peering when you’re connecting a small, fixed number of VPCs — AWS’s own guidance points to peering for straightforward hub-and-spoke or mesh connectivity between a limited set of VPCs where routing complexity is manageable. It’s free for same-AZ traffic and it’s the fastest of the three options.
Choose Transit Gateway once VPC count climbs into the dozens or you need hybrid connectivity to on-premises networks. The $0.05/hour-per-attachment plus $0.02/GB cost is real — AWS’s own VPN pricing examples show a 50-site deployment running at 1.25 Gbps through a Transit Gateway hub billing out to $5,767.70 per month as of August 2026 — but it replaces a peering mesh that becomes operationally unmanageable well before it becomes technically impossible, and the per-site math improved further in November 2025, when AWS launched a VPN Concentrator that consolidates up to 100 sites behind a single Transit Gateway attachment instead of requiring one VPN attachment per site.
Choose PrivateLink whenever the requirement is “let others reach this one service” rather than “connect these networks.” It’s the only one of the three built for SaaS-style, multi-tenant, or compliance-driven isolation, and its per-service billing model means cost tracks the number of published APIs, not the number of VPCs in your organization.
Most production AWS environments beyond a certain size end up running all three simultaneously — Transit Gateway as the hybrid and multi-VPC backbone, PrivateLink for service exposure across accounts, and the occasional direct VPC Peering link for a specific low-latency pair that doesn’t need the hub. Treating this as an either/or decision is usually where the over-engineering, or the accidental cost overrun, starts.
Frequently Asked Questions
Is AWS Transit Gateway more expensive than VPC Peering?
Yes, for small numbers of VPCs. Transit Gateway charges $0.05/hour per attachment plus $0.02/GB processed, even for same-AZ traffic, while VPC Peering is free for same-AZ transfer and has no hourly fee. AWS’s own Transit Gateway Black Belt technical deck listed those exact same rates — $0.05/hour per attachment and $0.02/GB — as still current as of January 2025, and the pricing model has held steady since. Transit Gateway becomes cost-effective once the alternative — a full peering mesh — requires dozens of individually billed and managed connections.
Can I use VPC Peering and Transit Gateway together?
Yes. Many production environments keep a Transit Gateway as the primary hub for most VPCs while maintaining a small number of direct VPC Peering connections for specific high-throughput, low-latency pairs that don’t need transitive routing through the hub.
Does PrivateLink replace the need for Transit Gateway or VPC Peering?
No. PrivateLink solves a different problem — exposing a specific service to consumers — not general network-to-network connectivity. AWS’s own documentation notes that sharing a VPC endpoint across VPCs still requires “layer-three connectivity through a transit gateway or VPC peering,” meaning PrivateLink is frequently deployed alongside one of the other two, not instead of them.
What is the maximum bandwidth for AWS Transit Gateway?
AWS documents up to 100 Gbps per Availability Zone per VPC attachment on Transit Gateway. VPC Peering has no separately published bandwidth ceiling beyond underlying VPC and instance networking limits, and PrivateLink throughput scales with the number of ENIs and NLB targets behind the interface endpoint rather than a single fixed number.
Does VPC Peering support transitive routing?
No. If VPC A peers with VPC B, and VPC B peers with VPC C, VPC A cannot reach VPC C through VPC B. Each peering connection is strictly point-to-point. This is one of the main reasons teams migrate to Transit Gateway once they need any-to-any connectivity across more than two or three VPCs.
Is PrivateLink more secure than Transit Gateway or VPC Peering?
PrivateLink offers stronger network-level isolation because it never exposes either party’s CIDR range or subnet layout to the other side — consumers only see the published service, not the provider’s network. Transit Gateway and VPC Peering both give connected parties IP-level reachability into each other’s address space (scoped by route tables and security groups), which is a broader attack surface even when properly configured.
How many VPCs can I connect with Transit Gateway before hitting limits?
Transit Gateway is designed for large-scale environments, with AWS’s architecture guidance built around organizations running hundreds to thousands of attachments across accounts and Regions. AWS’s 2025 Transit Gateway Black Belt deep dive documents the concrete ceiling: up to 5,000 attachments per Transit Gateway and up to 10,000 routes per route table. Exact attachment quotas are account and Region specific and can be increased through AWS Service Quotas, so teams planning very large deployments should check current quota limits directly in the AWS console before finalizing architecture.
Does data transfer through PrivateLink cross the public internet?
No. AWS explicitly designed PrivateLink so that traffic between consumer and provider stays entirely on the AWS network backbone. This is the core reason regulated industries favor it for cross-account service access — it avoids the public internet exposure that other connectivity patterns can introduce if misconfigured.
For the full category of cloud infrastructure coverage, see tech-insider.org’s Cloud Computing section.
