Hybrid Network with AWS Transit Gateway
An on-premises network reaches multiple AWS VPC spokes through Direct Connect and a centrally managed AWS Transit Gateway.
Open editable diagramArchitecture diagram
Edit this exact diagram
Open on the canvasHybrid AWS network diagram with an on-premises data center, Direct Connect, Transit Gateway, and application and data VPC spokes. The image links to a fully editable BuildPlane starter.
Overview
An on-premises corporate network enters AWS through Direct Connect and attaches to a regional Transit Gateway. The gateway applies centralized routing policy before traffic reaches separate application and data-service VPC spokes.
Components
- AWS Direct Connect: A dedicated private connection carries hybrid traffic into AWS.
- AWS Transit Gateway: The regional hub connects the private circuit and multiple VPC attachments.
- Application and data VPCs: Separate spokes create workload and policy boundaries while sharing the network hub.
Hybrid Routing Flow
- On-premises prefixes enter AWS over the Direct Connect connection.
- Transit Gateway evaluates attachment and route-table policy for each destination.
- Approved traffic reaches the application or shared data services spoke VPC.
Customize First
- Add redundant Direct Connect locations and a tested VPN backup path.
- Separate production, non-production, inspection, and shared-service route tables.
- Plan overlapping CIDR remediation before attaching acquired or legacy networks.
Design rationale
Decisions that shape this architecture
Separate connectivity from VPC routing
Direct Connect provides the private circuit, while Transit Gateway handles attachments and route policy. Each layer can change without redesigning every VPC.
Use VPC spokes as blast-radius boundaries
Application and data services live in separate spokes so route tables and inspection policy can allow only required communication.
Centralize route intent
Transit Gateway route tables make shared services, segmentation, and propagation policy visible rather than relying on many independent peering relationships.
Before production
Operational checks
Use redundant Direct Connect connections in separate locations and test the backup path.
Monitor BGP sessions, route changes, packet loss, attachment health, and capacity.
Validate segmentation with route-table and firewall tests from every trust zone.
Maintain an address plan that prevents overlapping CIDRs across attached networks.
Scope and tradeoffs
What this diagram does not solve
One drawn connection is not a resilient design
Production connectivity normally needs redundant circuits, locations, customer devices, and a tested VPN or alternate path.
Transit Gateway does not inspect traffic by itself
Add an inspection VPC, firewalls, and explicit routing when policy requires traffic filtering beyond security groups and network ACLs.
Common questions
Frequently asked questions
Why use Transit Gateway instead of VPC peering?
Transit Gateway provides a central routing hub and scales operationally better when many VPCs and hybrid networks need controlled connectivity.
Does Direct Connect encrypt traffic?
A private circuit is not automatically end-to-end encryption. Use supported encryption options or an overlay such as IPsec when confidentiality requirements demand it.
Can this design span multiple Regions?
Yes. Regional Transit Gateways can be peered, but cross-Region routing, inspection, failure handling, and cost should be designed explicitly.
Keep exploring
Related AWS architectures
Public and Private Subnets in an AWS VPC
This VPC pattern makes exposure decisions explicit. The load balancer and NAT gateway live in the public path, application compute accepts traffic only from the load balancer, and the database has no direct route from the internet.
Explore the architecture
Production-Grade Highly Available Web Platform on AWS
This reference expands the three-tier baseline with a global edge, separate scaling domains, caching, read scaling, private egress, secrets, backups, and operations. It is intended for teams evaluating a conventional production web platform rather than a minimal learning diagram.
Explore the architecture
Database Migration to Amazon Aurora with AWS DMS
This migration architecture separates continuous data replication from application traffic cutover. It helps teams reason about compatibility, target validation, replication lag, reconciliation, write freeze, rollback, and the exact moment Aurora becomes the production system of record.
Explore the architectureFrom reference to working draft
Adapt this architecture with your AWS AI Agent
Start from the exact diagram in this guide. Change requirements, challenge a decision, or ask what fails first, while keeping the architecture editable.