Transit Gateway Patterns

Parent: MongoDB Atlas AWS Networking · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Transit Gateway Patterns; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] Security group referencing is not supported by multicast on Transit Gateway. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]

Structure and components

[low] To share a VPC endpoint with other VPCs or an on-premises environment, layer-three connectivity through a transit gateway or VPC peering is required, along with Route 53 Resolver for hybrid DNS. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ [source]

How it works

[low] Security group referencing is not supported when extending a VPC to selected AWS Local Zones or AWS Outposts through a transit gateway, and the flag must remain disabled for these VPCs to avoid service interruptions. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]
[low] When Security Group Referencing is disabled at the Transit Gateway level, instance-to-instance traffic relying solely on referenced security groups is dropped unless it matches another rule using IPv4 or IPv6 address/CIDR. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]

Measurements and reference values

[low] A VPC endpoint elastic network interface provides 10 Gbps throughput, although this can burst higher. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ [source]

Problems, failure modes and limitations

[low] Security groups cannot be referenced across different AWS Regions; both VPCs must be attached to the same transit gateway and reside in the same Region. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]

Facts and statements

[high] AWS Transit Gateway can be used with a VPC connected to MongoDB Atlas via AWS PrivateLink to share interface endpoints between multiple VPCs and on-premises environments. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md, https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ [source]
[low] In a multi-Region architecture, Transit Gateways in each Region must be peered together to route traffic between VPCs. Sources: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html [source]
[low] A centralized approach hosting interface endpoints in a single VPC allows spoke VPCs to access them via Transit Gateway, but managing least privilege policies for all spokes on a single endpoint can increase complexity. Sources: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html [source]
[low] VPC peers do not support pass-through routing, preventing organizations using transit gateways for IPSEC tunnels or external networks from accessing Atlas servers via these peer connections. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-9154 [source]
[low] Security Group Referencing Support is disabled by default at the Transit Gateway level but enabled by default on Transit Gateway VPC attachments. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]
[low] To use Security Group Referencing Support, the feature must be enabled on both the transit gateway and the Transit Gateway VPC attachment. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]
[low] Outbound security rules referencing over Transit Gateway are not supported at this time. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]
[low] Cross-referencing security groups from a VPC in a different AWS account through Transit Gateway is possible, allowing reference of security groups defined in one account within rules in another. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]
[low] VPC endpoints and Route 53 Resolver inbound endpoints should use two or more Availability Zones for high availability. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ [source]
[low] A Private Hosted Zone (PHZ) supports 100 associated VPCs, and a VPC supports 20 VPC endpoints by default, which can be increased to 40. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ [source]
[low] An update on October 6, 2025, introduced Amazon Route 53 Profiles, simplifying the design approach for sharing endpoints and making the previous complex approach no longer recommended. (verified as of 2026-10-15) Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/ [source]
[low] Security group referencing does not work across AWS Gateway Load Balancer, AWS Network Firewall, or third-party middle-box/bump-in-the-wire appliances. Sources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway [source]

Related concepts

Gateway — is a part of Transit Gateway Patterns
Transit — is a part of Transit Gateway Patterns
Patterns — is a part of Transit Gateway Patterns

Children

No children recorded.

← the whole tree · 3D view· how to read this page