1 min lesson
Connectivity at scale
For each case in "Connectivity at scale", name the signal and the response you would use.
Step 1 of 2
Connectivity at scalepeering, Transit Gateway, PrivateLink
Two VPCs that need to talk can peer directly and that is fine for a handful. The trouble is that peering is non-transitive and the mesh grows as the square of the VPC count. Once you have many VPCs and accounts, a Transit Gateway becomes the hub everything routes through.
Direct 1:1 link between two VPCs.
Non-transitive: A↔B and B↔C does not give A↔C.
Cheap and simple for a small fixed set.
A hub-and-spoke router for many VPCs and accounts.
Transitive routing with route tables per attachment.
Scales the topology; adds per-attachment and per-GB cost.
Exposes one service over a private endpoint.
Consumer reaches it without route/CIDR overlap concerns.
Best when you want a service, not full network reachability.
For reaching AWS services themselves (S3, ECR, Secrets Manager) from private subnets, use VPC endpoints. A gateway endpoint for S3 and DynamoDB or an interface endpoint for the rest keeps that traffic off the NAT path and off the public internet entirely. It cuts NAT cost and shrinks the attack surface in one move.