# Transit Gateway Patterns > Depth-first rabbithole dossier for Transit Gateway Patterns; source-anchored research pack. Parent: [MongoDB Atlas AWS Networking](https://llms-explorer.com/tree/mongodb-atlas-aws-networking/) · 6 facets · 18 facts · page: https://llms-explorer.com/tree/transit-gateway-patterns/ ## Definitions - [low] Security group referencing is not supported by multicast on Transit Gateway. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#core` ## Structure and components - [low] To share a VPC endpoint with other VPCs or an on-premises environment, layer-three connectivity through a transit gateway or VPC peering is required, along with Route 53 Resolver for hybrid DNS. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` ## How it works - [low] Security group referencing is not supported when extending a VPC to selected AWS Local Zones or AWS Outposts through a transit gateway, and the flag must remain disabled for these VPCs to avoid service interruptions. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#antipatterns` - [low] When Security Group Referencing is disabled at the Transit Gateway level, instance-to-instance traffic relying solely on referenced security groups is dropped unless it matches another rule using IPv4 or IPv6 address/CIDR. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#troubleshooting` ## Measurements and reference values - [low] A VPC endpoint elastic network interface provides 10 Gbps throughput, although this can burst higher. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` ## Problems, failure modes and limitations - [low] Security groups cannot be referenced across different AWS Regions; both VPCs must be attached to the same transit gateway and reside in the same Region. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#core` ## Facts and statements - [high] AWS Transit Gateway can be used with a VPC connected to MongoDB Atlas via AWS PrivateLink to share interface endpoints between multiple VPCs and on-premises environments. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md, https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] In a multi-Region architecture, Transit Gateways in each Region must be peered together to route traffic between VPCs. Sources: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] A centralized approach hosting interface endpoints in a single VPC allows spoke VPCs to access them via Transit Gateway, but managing least privilege policies for all spokes on a single endpoint can increase complexity. Sources: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] VPC peers do not support pass-through routing, preventing organizations using transit gateways for IPSEC tunnels or external networks from accessing Atlas servers via these peer connections. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-9154 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] Security Group Referencing Support is disabled by default at the Transit Gateway level but enabled by default on Transit Gateway VPC attachments. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#core` - [low] To use Security Group Referencing Support, the feature must be enabled on both the transit gateway and the Transit Gateway VPC attachment. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#core` - [low] Outbound security rules referencing over Transit Gateway are not supported at this time. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#core` - [low] Cross-referencing security groups from a VPC in a different AWS account through Transit Gateway is possible, allowing reference of security groups defined in one account within rules in another. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#core` - [low] VPC endpoints and Route 53 Resolver inbound endpoints should use two or more Availability Zones for high availability. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] A Private Hosted Zone (PHZ) supports 100 associated VPCs, and a VPC supports 20 VPC endpoints by default, which can be increased to 40. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] An update on October 6, 2025, introduced Amazon Route 53 Profiles, simplifying the design approach for sharing endpoints and making the previous complex approach no longer recommended. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#patterns` - [low] Security group referencing does not work across AWS Gateway Load Balancer, AWS Network Firewall, or third-party middle-box/bump-in-the-wire appliances. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/transit-gateway-patterns-bc8ff5b699/rabbithole-synthesis.md#antipatterns` ## Related concepts - Gateway — is a part of Transit Gateway Patterns - Transit — is a part of Transit Gateway Patterns - Patterns — is a part of Transit Gateway Patterns