Search across all documentation pages
Hybrid and global networks fail in expensive, hard-to-debug ways: an overlapping CIDR discovered the day two companies merge, a Direct Connect cut with no backup, a flat Transit Gateway that lets a compromised dev VPC reach production, a cross-region link that shows available but routes nothing.
Walk this list before you ship code that touches Direct Connect, Transit Gateway, or Site-to-Site VPN, and use it as a review checklist afterward. Each item is a rule with a one-line rationale.
/8 split into per-region /12s) so a region can grow and its prefixes still summarize cleanly in BGP.Attach the VPN backup to the same hub as Direct Connect so both advertise the same prefixes.
# --- Python (boto3) ---
import boto3
ec2 = boto3.client("ec2", region_name="us-east-1")
cgw = ec2.create_customer_gateway(
Type="ipsec.1", IpAddress="203.0.113.10", BgpAsn=65001)
ec2.create_vpn_connection(
Type="ipsec.1",
CustomerGatewayId=cgw["CustomerGateway"]["CustomerGatewayId"],
TransitGatewayId="tgw-0abc123",
Options={"StaticRoutesOnly": False}, # dynamic for automatic failover
)// --- TypeScript (AWS SDK v3) ---
import { EC2Client, CreateCustomerGatewayCommand, CreateVpnConnectionCommand } from "@aws-sdk/client-ec2";
const ec2 = new EC2Client({ region: "us-east-1" });
const cgw = await ec2.send(new CreateCustomerGatewayCommand({
Type: "ipsec.1", IpAddress: "203.0.113.10", BgpAsn: 65001,
}));
await ec2.send(new CreateVpnConnectionCommand({
Type: "ipsec.1",
CustomerGatewayId: cgw.CustomerGateway?.CustomerGatewayId,
TransitGatewayId: "tgw-0abc123",
Options: { StaticRoutesOnly: false }, // dynamic for automatic failover
}));Verify a cross-region route actually landed rather than trusting available status.
# --- Python (boto3) ---
resp = ec2.search_transit_gateway_routes(
TransitGatewayRouteTableId="tgw-rtb-east",
Filters=[{"Name": "route-search.subnet-of-match", "Values": ["10.20.0.0/16"]}],
)
for r in resp["Routes"]:
print(r["DestinationCidrBlock"], r["State"], r["Type"])// --- TypeScript (AWS SDK v3) ---
import { SearchTransitGatewayRoutesCommand } from "@aws-sdk/client-ec2";
const resp = await ec2.send(new SearchTransitGatewayRoutesCommand({
TransitGatewayRouteTableId: "tgw-rtb-east",
Filters: [{ Name: "route-search.subnet-of-match", Values: ["10.20.0.0/16"] }],
}));
for (const r of resp.Routes ?? []) {
console.log(r.DestinationCidrBlock, r.State, r.Type);
}0.0.0.0/0 at a firewall/inspection VPC attachment when you need centralized traffic inspection.allowedPrefixesToDirectConnectGateway on the Direct Connect gateway association so on-prem cannot inject arbitrary routes.Build segmentation by leaving propagation out, not by adding blocks.
# --- Python (boto3) ---
# prod reaches shared services, but dev's routes are never propagated into prod
ec2.associate_transit_gateway_route_table(
TransitGatewayRouteTableId="tgw-rtb-prod",
TransitGatewayAttachmentId="tgw-attach-prod")
ec2.enable_transit_gateway_route_table_propagation(
TransitGatewayRouteTableId="tgw-rtb-prod",
TransitGatewayAttachmentId="tgw-attach-shared")// --- TypeScript (AWS SDK v3) ---
import {
AssociateTransitGatewayRouteTableCommand,
EnableTransitGatewayRouteTablePropagationCommand,
} from "@aws-sdk/client-ec2";
// prod reaches shared services, but dev's routes are never propagated into prod
await ec2.send(new AssociateTransitGatewayRouteTableCommand({
TransitGatewayRouteTableId: "tgw-rtb-prod",
TransitGatewayAttachmentId: "tgw-attach-prod",
}));
await ec2.send(new EnableTransitGatewayRouteTablePropagationCommand({
TransitGatewayRouteTableId: "tgw-rtb-prod",
TransitGatewayAttachmentId: "tgw-attach-shared",
}));ConnectionState and VPN TunnelState/VgwTelemetry so an outage pages you before users notice.Because Transit Gateway and Direct Connect cannot route between overlapping ranges, and re-addressing a live network is extremely disruptive. A single non-overlapping scheme across regions and accounts keeps all future connectivity possible.
Not for anything you cannot afford to lose. A single link is a single point of failure. Add a second connection at another location, or at minimum a dynamic-routing VPN backup on the same hub.
Static routes do not withdraw when a link goes down, so the Transit Gateway keeps sending traffic into a dead path. BGP routes withdraw on failure, which is what shifts traffic to the backup automatically.
Cross-region Transit Gateway peering does not propagate routes. Every route across the peering attachment must be added statically on both regions' route tables, even though the attachment shows available.
Disable default association/propagation, give each environment its own route table, and never propagate dev's routes into prod's table (or vice versa). Both can still reach a shared-services table. Isolation comes from omitting propagation.
Transit Gateway per-attachment hourly charges and per-GB data processing, cross-region peering data transfer billed on both sides, and Direct Connect port and data-transfer-out charges. Tag resources and keep chatty traffic region-local.
Alarm on CloudWatch metrics - Direct Connect ConnectionState, VPN tunnel state and VgwTelemetry - rather than polling. And periodically confirm both VPN tunnels are UP so the backup is proven before an outage.
Yes. Set allowedPrefixesToDirectConnectGateway on the Direct Connect gateway association so on-premises can only advertise expected prefixes, preventing accidental or malicious route injection.
Share the Transit Gateway via AWS RAM, let spoke accounts create attachments that land in pendingAcceptance, and have the network account accept and control association/propagation - keeping routing authority central.
Yes. The Transit Gateway route tables are only half the path. Each VPC subnet route table needs a route sending remote CIDRs to the Transit Gateway attachment, or traffic never leaves the VPC.
Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).
Reviewed by Chris St. John·Last updated Jul 23, 2026