AWS Architecture Guide

Hybrid Connectivity and Transit Architecture

What This Chapter Is About

Explain enterprise connectivity across VPCs, accounts, Regions, and on-premises networks as a routing and operating model choice.

Keep one durable idea in view:

Transit design decides how many network relationships a team must manage directly and where shared connectivity responsibilities should live.

Sections

  1. Hybrid Connectivity Mental Model

  2. VPC Peering, Transit Gateway, and Shared Connectivity

  3. Site-to-Site VPN, Direct Connect, and Redundant Links

  4. DNS, Route 53 Resolver, and Cross-Network Name Resolution

  5. Enterprise Hybrid Transit Scenario

How the Chapter Develops

The chapter develops in this order:

  1. Start with the question of which networks need to communicate and where that connectivity should be centralized.

  2. Compare direct network relationships like VPC peering with transit patterns such as Transit Gateway.

  3. Introduce hybrid links to on-premises environments with VPN and Direct Connect trade-offs.

  4. Explain how DNS and Route 53 Resolver keep name resolution usable across network boundaries.

  5. Apply the model to an enterprise migration that needs transit, redundancy, and clear ownership.

Together, these sections show that hybrid networking is about scalable relationship management, not just attaching more connections.

What You Will Be Able to Do

By the end of this chapter, the reader should be able to:

  • Explain when direct VPC-to-VPC connectivity is sufficient and when transit is healthier.

  • Describe the roles of Transit Gateway, VPN, and Direct Connect in hybrid architecture.

  • Recognize why route propagation and shared connectivity ownership matter in multi-account estates.

  • Explain why DNS design is part of connectivity architecture rather than an afterthought.

  • Recommend a practical hybrid transit pattern for an enterprise migration.

Key Ideas

  • Connectivity choices should minimize fragile one-off network relationships.

  • Transit patterns help centralize routing intent without erasing workload ownership.

  • VPN and Direct Connect solve different reliability, bandwidth, and lead-time needs.

  • DNS often becomes the hidden source of hybrid networking confusion.

  • Hybrid architecture must balance redundancy, cost, operational skill, and growth.