LEARN. PRACTICE. GROW.Concept and mechanism
In a Transit Gateway, association and propagation have different roles. The table associated with an attachment guides traffic entering through it; propagation installs that attachment’s routes in selected tables. Associating development with a table is insufficient if that table still contains unwanted paths to production. Also check subnet routes and the return path. A stateful firewall may require path consistency across AZs. In an inspection VPC model, appliance mode helps keep a flow in the same AZ for that attachment, but does not fix every route by itself.
Guided application
Draw the DNS-query direction before choosing endpoints. Route 53 VPC Resolver, formerly Route 53 Resolver, receives datacenter queries through inbound endpoints. For internal datacenter names queried from a VPC, use the outbound path and conditional rules associated with the right VPCs. IP connectivity does not replace this configuration. With Direct Connect, two connections at one location remain exposed to loss of that location. Plan diversity and test BGP failover within an authorized window. Finally, a private connection does not prove encryption: confirm the transit-protection option and the segments actually protected, without assuming Direct Connect encrypts by default.
Development must resolve shared DNS without reaching production servers. The permitted-path matrix guides tables, propagation, and validation.
Common pitfalls
Propagating everything; reversing inbound and outbound; testing only cable failure when the risk is location loss; confusing private with encrypted.
Related topics: Resilience, state, and releases · Security, performance, and cost in design
Validate the complete path and the failure domain the requirement actually names.
Reference: Transit Gateway routing mechanisms · SAP-C02