A company has 12 VPCs that all need to communicate with each other and with an on-premises data center over a single VPN connection. Using only VPC peering, the required full mesh would need 66 separate peering connections and 66 corresponding sets of route table entries. Which alternative most directly solves both the connection-count and the transitive-routing problems?
- Attach all 12 VPCs and the VPN connection to a single Transit Gateway
- Create one central "hub" VPC and peer all 11 others to it
- Use VPC peering but summarize routes to reduce the entry count
- Replace all VPCs with a single VPC containing 12 subnets
Correct answer: A. Attach all 12 VPCs and the VPN connection to a single Transit Gateway
A Transit Gateway acts as a regional routing hub: each VPC and the VPN attachment connects to it once, replacing the 66-connection full mesh with 13 simple attachments, and Transit Gateway natively supports transitive routing between attachments, which VPC peering never does. Option B looks similar but fails on transitivity: routing traffic through a central hub VPC via peering still would not let two spoke VPCs reach each other, because peering itself remains strictly point-to-point and non-transitive no matter what topology of peering connections is built around it. Option C is not achievable, since peering route table entries cannot be summarized away; each peering connection still needs its own explicit route per attached CIDR block, regardless of how the routes are organized. Option D is impractical and unrelated to the stated requirement, and it would also force resolving any overlapping CIDR ranges across the merged environment and rebuilding existing infrastructure from scratch.
Source: AWS Transit Gateway docs: How Transit Gateways work