VPN vs VPC Peering vs Transit Gateway

VPN (Virtual Private Network)

Creates an encrypted tunnel between two endpoints over a network.
Example flow:
- Your company's VPN Gateway encrypts the original packet, including its private source and destination IP addresses.
- It wraps that packet inside a new packet with the VPN Gateways' public IP addresses and sends it over the internet.
- The AWS VPN Gateway removes the outer packet, decrypts the original packet, and forwards it to its destination inside the VPC.
This lets both networks communicate securely using private IP addresses.

Creates a direct, private connection between two VPCs (Virtual Private Clouds).
Uses AWS infrastructure, so traffic does not travel over the public internet.
Important limitation: VPC Peering is not transitive.
- If VPC A connects to VPC B, and VPC B connects to VPC C, VPC A cannot automatically communicate with VPC C.
- VPC A needs its own peering connection to VPC C.

Connecting 20 VPCs with individual VPC Peering connections can become difficult to manage.
AWS Transit Gateway acts as a central router.
- Attach VPCs to the Transit Gateway instead of connecting every VPC directly to every other VPC.
- It routes traffic between these networks based on its routing tables.
- It can connect an on-premises data center through an AWS Site-to-Site VPN.

VPN: creates an encrypted tunnel between networks.
VPC Peering: directly connects two VPCs using private IP addresses, but does not support transitive routing.
Transit Gateway: acts as a central router that connects multiple VPCs and on-premises networks.