Skip to main content
resource · aws

AWS Transit Gateway

live rule families
1
schedulable
no
category
networking-services

Does ZopNight manage AWS Transit Gateway?

AWS Transit Gateway bills per attachment-hour for every connected VPC and VPN, plus a per-GB charge on data processed through the hub. ZopNight discovers gateways on the 6-hour cycle, reads 90 days of CloudWatch TransitGateway metrics, attributes cost from Cost Explorer or CUR 2.0, and flags attachments passing no traffic.

Rules that fire on AWS Transit Gateway

At a glance

AWS Transit Gateway coverage facts.
Field Value
Scheduling notesdiscovery, metrics, cost tracking, and recommendations only.

AWS Transit Gateway is a regional hub that interconnects VPCs and on-premises networks, billed per attachment-hour plus per GB processed. Attachment fees accumulate across every connected VPC, making unused attachments a steady drain.

A hub that meters every spoke

Transit Gateway pricing scales with connectivity, not usage: each VPC, VPN, or Direct Connect attachment bills hourly for existing, and data processed through the gateway bills per GB on top. A hub with forty spoke VPCs runs forty simultaneous hourly meters. That makes the cost profile unusual: the gateway grows more expensive every time an account or VPC joins the network, whether or not the new spoke sends a single packet.

Metrics-backed attachment analysis

ZopNight discovers transit gateways on the 6-hour cycle and pulls hourly CloudWatch metrics from the TransitGateway namespace with a 90-day lookback, alongside per-resource cost from Cost Explorer or CUR 2.0. The lookback is what makes the unused-attachment recommendation trustworthy: an attachment with flat byte counters across 90 days is not “quiet this week”, it is disconnected in practice, and its hourly fee plus its spoke-side routing complexity are both recoverable. The gateway itself has no off switch, so findings resolve through detaching, not scheduling.

Spokes that stopped spoking

Attachment waste follows organizational churn. Sandbox and project VPCs get attached to the hub by default via account-vending automation, then sit dark. Teams migrate workloads into a consolidated VPC and the vacated VPC keeps its attachment because removing it needs a network-team ticket. VPN attachments to offices and datacenters persist after the site moved to Direct Connect or closed. Each is one hourly meter nobody is watching.

Surveying the hub in the VPC console

Transit gateways and their attachments live in the VPC console under their own views, showing per-attachment type, state, and owning account. The per-attachment CloudWatch byte metrics are the ground truth for utilization. Cross-account attachments deserve care: the attachment may look idle from the hub owner’s side while the spoke account still depends on it for rare but critical paths. Confirm with the owner before detaching.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·