Transit-Gateway

Hub-and-spoke: three private pods reach one shared-services VPC over the transit gateway; the service cannot reach back

Shared services for isolated tenants: PrivateTGW subnets

Three pods with identical addressing all need the same repo, WSUS and AD. One shared-services VPC serves them all through the transit gateway, and can’t reach back into any of them.

16 September 2026 · Updated 1 October 2026 · 5 min · Adam Stretton