Hybrid Network with AWS Transit Gateway
An on-premises network reaches multiple AWS VPC spokes through Direct Connect and a centrally managed AWS Transit Gateway.
Open editable diagramArchitecture diagram
Edit this exact diagram
Open on the canvasHybrid AWS network diagram with an on-premises data center, Direct Connect, Transit Gateway, and application and data VPC spokes. The image links to a fully editable BuildPlane starter.
Overview
An on-premises corporate network enters AWS through Direct Connect and attaches to a regional Transit Gateway. The gateway applies centralized routing policy before traffic reaches separate application and data-service VPC spokes.
Components
- AWS Direct Connect: A dedicated private connection carries hybrid traffic into AWS.
- AWS Transit Gateway: The regional hub connects the private circuit and multiple VPC attachments.
- Application and data VPCs: Separate spokes create workload and policy boundaries while sharing the network hub.
Hybrid Routing Flow
- On-premises prefixes enter AWS over the Direct Connect connection.
- Transit Gateway evaluates attachment and route-table policy for each destination.
- Approved traffic reaches the application or shared data services spoke VPC.
Customize First
- Add redundant Direct Connect locations and a tested VPN backup path.
- Separate production, non-production, inspection, and shared-service route tables.
- Plan overlapping CIDR remediation before attaching acquired or legacy networks.
Related AWS guides
Understand the decisions behind this diagram
Use these practical explanations to compare services, failure boundaries, and operating tradeoffs before adapting the architecture.
Networking
AWS VPC Explained: Subnets, Routes, Gateways, and Security Groups
A VPC is a network you assemble from eight components. Here is what each one does, which decisions are permanent, and the layout that satisfies most production requirements.
Read the guideEngineering Career
Security Clearances for IT Jobs and AWS GovCloud Roles
A security clearance, a background investigation, and AWS GovCloud eligibility are related to government work, but they are not the same requirement.
Read the guideDesign rationale
Decisions that shape this architecture
Separate connectivity from VPC routing
Direct Connect provides the private circuit, while Transit Gateway handles attachments and route policy. Each layer can change without redesigning every VPC.
Use VPC spokes as blast-radius boundaries
Application and data services live in separate spokes so route tables and inspection policy can allow only required communication.
Centralize route intent
Transit Gateway route tables make shared services, segmentation, and propagation policy visible rather than relying on many independent peering relationships.
Before production
Operational checks
Use redundant Direct Connect connections in separate locations and test the backup path.
Monitor BGP sessions, route changes, packet loss, attachment health, and capacity.
Validate segmentation with route-table and firewall tests from every trust zone.
Maintain an address plan that prevents overlapping CIDRs across attached networks.
Scope and tradeoffs
What this diagram does not solve
One drawn connection is not a resilient design
Production connectivity normally needs redundant circuits, locations, customer devices, and a tested VPN or alternate path.
Transit Gateway does not inspect traffic by itself
Add an inspection VPC, firewalls, and explicit routing when policy requires traffic filtering beyond security groups and network ACLs.
Common questions
Frequently asked questions
Why use Transit Gateway instead of VPC peering?
Transit Gateway provides a central routing hub and scales operationally better when many VPCs and hybrid networks need controlled connectivity.
Does Direct Connect encrypt traffic?
A private circuit is not automatically end-to-end encryption. Use supported encryption options or an overlay such as IPsec when confidentiality requirements demand it.
Can this design span multiple Regions?
Yes. Regional Transit Gateways can be peered, but cross-Region routing, inspection, failure handling, and cost should be designed explicitly.
Keep exploring
Related AWS architectures
Public and Private Subnets in an AWS VPC
This VPC pattern makes exposure decisions explicit and auditable. The load balancer and NAT gateway are the only resources in the public path; application compute accepts traffic solely from the load balancer security group; the database accepts connections solely from the application security group and has no route to or from the internet. Because every layer is enforced by a route table and a security group reference rather than by convention, you can answer "what is reachable from the internet?" by reading the diagram. Everything else in a production build, such as a second Availability Zone, VPC endpoints, and flow logs, attaches to this skeleton without changing it.
Explore the architecture
Production-Grade Highly Available Web Platform on AWS
This reference expands the three-tier baseline with a global edge, separate scaling domains, caching, read scaling, private egress, secrets, backups, and operations. It is intended for teams evaluating a conventional production web platform rather than a minimal learning diagram.
Explore the architecture
Database Migration to Amazon Aurora with AWS DMS
This migration architecture separates continuous data replication from application traffic cutover. It helps teams reason about compatibility, target validation, replication lag, reconciliation, write freeze, rollback, and the exact moment Aurora becomes the production system of record.
Explore the architectureFrom reference to working draft
Adapt this architecture with your AWS AI Agent
Start from the exact diagram in this guide. Change requirements, challenge a decision, or ask what fails first, while keeping the architecture editable.