Q: When would you choose AWS Transit Gateway versus VPC Peering, and why?

VPC Peering does NOT support transitive routing (VPC A cannot talk to VPC C through VPC B). For N VPCs to communicate fully via peering, you require `N*(N-1)/2` peering connections (e.g. 50 VPCs require 1,225 peering links), creating an unmanageable routing table mesh. Transit Gateway acts as a central hub (hub-and-spoke), supporting transitive routing across hundreds of VPCs, VPNs, and Direct Connect links.

VPC Peering has no bandwidth limits or single-point-of-failure choke points; traffic flows over the AWS global backbone at line rate with zero added latency. Transit Gateway has a limit of 50 Gbps per VPC attachment burst (expandable via ECMP) and introduces a negligible sub-millisecond hop.

Cost structures are fundamentally different: - **VPC Peering**: $0.00 base cost per hour. Standard inter-AZ data transfer fees apply ($0.01/GB). Same-AZ peering is completely FREE. - **Transit Gateway**: $0.05/hour per attachment ($36.50/month per VPC) + $0.02 per GB data processing fee ON TOP of standard data transfer fees.

# Cost Example: 20 VPCs transferring 50 TB/month
# VPC Peering: ~$500 in data transfer
# Transit Gateway: (20 * $36.50) + (50,000 GB * $0.02) + data transfer = ~$2,230/month

Transit Gateway allows routing all east-west and north-south traffic through a centralized 'Security/Inspection VPC' containing AWS Network Firewall or Palo Alto appliances before forwarding to destinations. VPC Peering cannot achieve this without complex proxying.