transitgateway

Configures AWS Transit Gateway hubs, VPC attachments, route tables, and hybrid connectivity.

Updated Sep 8, 2026
One-click install
npx skills add https://github.com/dennisvink/yolomancer --skill transitgateway-dennisvink
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: transitgateway
Source: https://github.com/dennisvink/yolomancer/tree/main/skills/aws/specialized-skills/networking-and-content-delivery-skills/transitgateway
Command: npx skills add https://github.com/dennisvink/yolomancer --skill transitgateway-dennisvink

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Connecting many VPCs and on-premises networks with point-to-point peering creates an unmanageable mesh, and misconfiguring a central transit gateway can silently drop traffic or expose isolated environments. This Skill provides expert procedures for building and operating AWS Transit Gateway correctly. ## Core Features & Use Cases - Hub and VPC Attachments: Create a Regional transit gateway, attach VPCs with dedicated per-Availability-Zone subnets, and check for overlapping CIDRs before connecting. - Segmentation and Inspection: Isolate environments with route tables, centralize egress through a GWLB or appliances, and force east-west traffic through AWS Network Firewall. - Hybrid and Multi-Region Connectivity: Connect on-premises networks over Site-to-Site VPN (with ECMP and acceleration) or Direct Connect, peer transit gateways across Regions, and migrate off VPC peering meshes. - Use Case: A platform team needs to connect 20 VPCs, isolate production from development, and route all outbound traffic through one inspected egress VPC. The Skill routes them to the matching reference procedure with exact CLI commands and security controls. ## Quick Start Ask the assistant to create a transit gateway in us-east-1 and attach your VPCs with segmentation disabled by default, following the transitgateway skill.

Frequently Asked Questions about transitgateway

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect multiple VPCs with AWS Transit Gateway?

Create a transit gateway in the target Region, then create a VPC attachment per VPC using a dedicated subnet in every Availability Zone that holds workloads. Add routes in each VPC subnet route table pointing the other VPCs' CIDRs at the transit gateway, and check for overlapping CIDRs first.

How do I isolate VPCs on a transit gateway using route tables?

Disable default route table association and propagation at creation, then build separate route tables per environment so isolated VPCs cannot reach each other. Retrofitting isolation onto an open hub requires re-associating every attachment, so decide segmentation before building.

Transit Gateway vs VPC peering: when should I migrate?

Migrate to a transit gateway when a peering mesh becomes hard to manage across many VPCs. Cut over one VPC at a time, replacing peering routes with transit gateway routes in both directions together, and keep peering connections as rollback until the hub path is verified.

Why does my stateful firewall drop traffic across Availability Zones on Transit Gateway?

By default a transit gateway keeps flows in the entry Availability Zone, so request and response can hit different appliances. Enable appliance mode on the inspection VPC attachment, and pair it with health-check-based failover since appliance mode disables cross-zone failover.

Can Transit Gateway aggregate bandwidth across multiple VPN tunnels?

Yes, via equal-cost multi-path (ECMP), but only with dynamic BGP routing and only when all tunnels terminate on the same transit gateway. Static VPN routes do not support ECMP and will pin traffic to one tunnel.

When should I not use AWS Transit Gateway?

Avoid it for single-VPC routing or peering between just two VPCs, where a simple VPC peering connection is cheaper and simpler. Direct Connect gateway and virtual interface setup belong to a separate Direct Connect workflow, and Route 53 DNS work is out of scope.