Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesChoose by the kind of access your workloads need: use VPC peering for a small number of direct VPC-to-VPC links, Transit Gateway for a regional routing hub, PrivateLink for private access to a specific service, VPC Lattice for application-level connectivity, and Cloud WAN when you need a global, multi-Region network. These patterns can be combined; the right choice depends on traffic direction, routing scope, address overlap, protocols, scale, and operational needs.
Start with the access pattern, not the service name
Before choosing a connectivity service, describe what one side must be able to reach on the other. “These VPCs need to talk” may mean broad IP routing, access to one provider service, or application-level communication with policy and visibility. Those are different requirements.
As an Amazon Associate I earn from qualifying purchases.
- Direct VPC connectivity: Do the networks need broad reachability, or only access to a defined service?
- Traffic direction: Is access initiated by a consumer to a provider service, or do both networks need routed communication?
- Scope: Is this a pair of VPCs, a growing regional network, or a global multi-Region design?
- Addressing and isolation: Do CIDR ranges overlap, and should consumers see the provider network or only its service?
- Operations: Which team will manage routes, attachments, endpoints, service networks, policies, logs, and troubleshooting?
- Protocol and cost: Confirm the workload’s protocol requirements and compare current charges for the actual topology. Relative cost depends on usage and design, so no one option is universally cheapest.
Compare the five options
| Option | Connectivity shape | Scope | Best fit |
|---|---|---|---|
| VPC peering | Direct, one-to-one VPC connection; no transit through a peered VPC | Pairwise links | A modest number of direct VPC relationships whose owners can manage each link |
| Transit Gateway | Hub-and-spoke routing through attachments and route tables; transitive routing is possible when configured | Regional hub, including hybrid connectivity | A growing regional network or a design connecting VPCs with on-premises networks |
| PrivateLink | Consumer-initiated private access to a particular service, not general bidirectional VPC routing | Service access | A consumer that needs a provider service without broad access to the provider VPC |
| VPC Lattice | Application-to-application or service-level connectivity | Application/service connectivity | A design where service-level access controls and access logs are relevant |
| Cloud WAN | Attachment-based network connectivity across multiple Regions | Global network | A global, multi-Region network-management requirement |
When VPC peering is the right fit
Peering is a direct relationship between two VPCs. It is a straightforward choice when the number of connections is small, the teams can coordinate route and security changes, and each connected pair needs direct network reachability.
Plan for separate links, not a mesh that routes through a hub
Peering is not transitive. If VPC A is peered with VPC B and VPC C, B cannot use A as a transit path to reach C; B and C need their own peering connection if they must communicate. As the number of VPCs grows, managing the links and associated routes becomes more involved.
#1 Best Overall
Choose it for a bounded topology
Evaluate peering when you have a limited set of stable VPC pairs and do not need centralized transit routing. AWS guidance identifies cost, bandwidth, and latency needs as factors that can favor peering in some designs, but these do not establish that peering is always cheaper or faster. Compare the current costs and requirements for your specific traffic pattern.
When Transit Gateway is a better regional hub
Transit Gateway connects networks through attachments and route tables. The attachment model includes VPCs, VPN connections, Direct Connect gateways, and peering with other transit gateways, among other options. Route-table configuration determines which attached networks can communicate; the hub supports transitive routing when routes and associations permit it.
Use it to consolidate regional routing
Transit Gateway is worth evaluating when a growing regional network has many VPCs, hybrid connectivity needs, or a topology where maintaining individual peer links is becoming difficult. A hub can centralize routing decisions, but it does not remove the need to design route tables, security controls, and ownership.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not assume a hub wins for every connection
For a small number of VPC pairs, a hub may add cost or operational overhead without solving a real routing problem. Compare the connection pattern, expected traffic, bandwidth and latency requirements, current pricing, and the team’s ability to operate the hub before making it the default.
When PrivateLink is better than network reachability
PrivateLink fits a provider-consumer relationship in which a consumer needs a particular service rather than broad connectivity to the provider’s VPC. The consumer initiates access to that service; this is not general, bidirectional VPC routing.
Use it to limit what consumers can reach
If the provider wants to expose a defined service without granting consumers access to its wider network, PrivateLink’s service-oriented pattern can provide a narrower access boundary than VPC-to-VPC routing. It is also a candidate when consumer and provider VPC CIDR ranges overlap: endpoint network interfaces in the consumer VPC avoid requiring the provider’s address space to be routed into that VPC.
Check the endpoint and Region requirements
Confirm that the specific service supports the endpoint type you need and is available in the intended Region. AWS’s connectivity whitepaper states that endpoint services are available in the Region where they are created, so validate the actual service and deployment design rather than assuming cross-Region availability.
When to evaluate VPC Lattice
VPC Lattice is positioned for application-to-application connectivity rather than as a general-purpose network transit hub. AWS comparison material includes service and service-network policies and access logs as relevant characteristics. Consider it when the design is about connecting services and applying service-level controls or gaining access visibility.
Before specifying an implementation, verify current documentation for supported targets, protocols, cross-account and cross-Region behavior, service-network design, and quotas. The available comparison evidence supports Lattice’s application-level positioning, but does not establish a complete current feature matrix.
When to evaluate Cloud WAN
Cloud WAN is the option to evaluate when the requirement is a global network spanning multiple Regions. AWS comparison material distinguishes its global, attachment-based scope from Transit Gateway’s regional role and includes segmentation as a comparison dimension.
That positioning is a starting point, not a complete design specification. Confirm current core-network policies, supported attachments, regional availability, quotas, and charges against the live service documentation before approving an architecture.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How to make the decision in a real design
- Write down the reachability requirement. Specify whether workloads need routed network access, access to one service, or application-level connectivity. Include who initiates connections and which protocols the workload requires.
- Map the network scope. Count the VPCs and links, identify any on-premises networks, and note whether the design is regional or spans multiple Regions.
- Check CIDR overlap and isolation. If address ranges overlap, or consumers must not reach the provider’s broader network, evaluate a service-oriented pattern such as PrivateLink rather than assuming VPC routing is appropriate.
- Test the topology as it will grow. For peering, account for every communicating pair. For a hub, define attachment and route-table behavior. For service patterns, define which consumers can reach which services.
- Validate operational and commercial fit. Compare current pricing for the expected traffic and endpoints or attachments; identify who owns route changes, policy updates, logging, and incident troubleshooting.
- Verify current service limits and availability. Check quotas and regional support for the exact design. Do not use comparison figures as live limits without confirmation.
Version-sensitive AWS comparison figures
The AWS comparison material surfaced for this guide lists the figures below. Its publication year was not stated, and the figures have not been independently verified as current quotas or throughput limits. Treat them as comparison-source figures only; check live service documentation and quotas before using them in capacity planning or an implementation decision.
Best Value
| Service or measure | Figure listed in AWS comparison material |
|---|---|
| Active VPC peering connections | 125 active peers per VPC |
| Transit Gateway attachments | 5,000 per Region |
| Cloud WAN attachments | 5,000 per core network |
| VPC Lattice service associations | 500 VPC associations per service |
| PrivateLink throughput | Up to 10 Gbps per Availability Zone, with automatic scaling up to 100 Gbps |
| VPC Lattice throughput | 10 Gbps per Availability Zone |
| Transit Gateway attachment throughput | Up to 100 Gbps (burst) |
These figures are not interchangeable: the comparison labels them with different scopes, and a listed throughput is not a guarantee of application performance. Use the current service limits and the workload’s tested requirements for final sizing.
Combining patterns can be the cleanest design
The options are not mutually exclusive. A regional network can use Transit Gateway for routed connectivity among networks while exposing a particular provider service through PrivateLink to consumers that should not receive broad VPC access. Likewise, a global design may require evaluating Cloud WAN for network scope while retaining service-oriented access where it better matches a consumer-provider relationship. Choose each component for the reachability it provides, then verify that routes, policies, and ownership fit together.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
