skills.rest
aws
awsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

transitgateway

Configures AWS Transit Gateway hubs, VPC attachments, route tables, and hybrid connectivity.

2.5k|282|Updated Apr 23, 2026
Search Tags:#AWS#VPN#VPC#Networking#transit gateway#route tables#hybrid connectivity
One-click install
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill transitgateway
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: transitgateway
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/networking-and-content-delivery-skills/transitgateway
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill transitgateway

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Connecting many VPCs and on-premises networks with point-to-point peering creates an unmanageable mesh, and misconfiguring a central transit gateway can silently drop traffic or expose isolated environments. This Skill provides guided, security-hardened procedures for building and operating AWS Transit Gateway correctly.

Core Features & Use Cases

  • Hub and Attachment Setup: Create a Regional transit gateway, attach VPCs with one dedicated subnet per Availability Zone, and check for overlapping CIDRs before attaching.
  • Segmentation and Inspection: Isolate environments with route tables, centralize egress through a GWLB or appliances, and force east-west traffic through AWS Network Firewall with appliance mode.
  • Hybrid and Multi-Region Connectivity: Connect on-premises networks over Site-to-Site VPN (with ECMP and accelerated VPN) or Direct Connect, peer transit gateways across Regions, and migrate off a VPC peering mesh without dropping traffic.
  • Use Case: A platform team needs to connect 20 VPCs across two Regions, isolate production from development, and route all outbound traffic through a central inspection VPC. The Skill walks them through hub creation, route table segmentation, and GWLB-based egress with the correct forward and return routes.

Quick Start

Ask the agent to create a transit gateway in us-east-1 and attach your VPCs with segmentation disabled by default, then follow the matching reference for your specific routing goal.

Frequently Asked Questions about transitgateway

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect multiple VPCs with AWS Transit Gateway?▼

Create a transit gateway in the target Region, then create a VPC attachment for each VPC using a dedicated subnet in every Availability Zone that holds workloads. Add routes in each VPC subnet route table pointing the other VPCs' CIDR ranges at the transit gateway, and check for overlapping CIDRs before attaching.

How do I isolate VPCs on a shared transit gateway?▼

Disable default route table association and propagation at creation, then build separate route tables per environment so isolated VPCs cannot reach each other. Retrofitting isolation onto an open hub requires re-associating every attachment, so decide segmentation intent before creating the gateway.

Transit Gateway vs VPC peering, which should I use?▼

Use a transit gateway when connecting many VPCs or on-premises networks through one hub; use VPC peering only for two VPCs. Unlike peering, a transit gateway does not route between overlapping CIDRs, so check for overlap before migrating off a peering mesh.

Why does my stateful firewall drop traffic across Availability Zones on Transit Gateway?▼

By default a transit gateway keeps flows in the entry Availability Zone, so request and response can hit different firewall appliances. Enable appliance mode on the inspection VPC attachment to pin each flow to one zone, and pair it with health-check-based failover since appliance mode disables cross-zone failover.

Can I aggregate bandwidth across multiple Site-to-Site VPN tunnels on Transit Gateway?▼

Yes, but only with equal-cost multi-path (ECMP), which requires dynamic BGP routing and tunnels terminating on the same transit gateway. Static VPN routes do not support ECMP and will pin traffic to a single tunnel.

When should I not use the transitgateway skill?▼

Do not use it for single-VPC routing, VPC peering between two VPCs (use the vpcpeering skill), Direct Connect gateway or virtual interface setup (use the directconnect skill), or Route 53 DNS work. It covers only the transit-gateway side of these designs.

Related Skills

Explore More Software Engineering Skills→
openshift-engopenshift-eng
112

HyperShift AWS Provider

Automate AWS-based HyperShift cluster provisioning with STS credentials and VPC configuration.

Community
Advanced
mashharukimashharuki
2

aws-observability

Configure AWS CloudWatch, X-Ray, CloudTrail, and ADOT observability services.

Community
Advanced
mreferremreferre

connecting-vpcs-with-peering

Create AWS VPC peering connections with route and DNS configuration.

Community
Advanced
XPRNetworkXPRNetwork
3

governance

Manage XPR Network governance communities, proposals, and votes via EOS RPC and Gov API.

Official
Advanced