AWS Transit Gateway
Does ZopNight manage AWS Transit Gateway?
AWS Transit Gateway bills per attachment-hour for every connected VPC and VPN, plus a per-GB charge on data processed through the hub. ZopNight discovers gateways on the 6-hour cycle, reads 90 days of CloudWatch TransitGateway metrics, attributes cost from Cost Explorer or CUR 2.0, and flags attachments passing no traffic.
Rules that fire on AWS Transit Gateway
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery, metrics, cost tracking, and recommendations only. |
AWS Transit Gateway is a regional hub that interconnects VPCs and on-premises networks, billed per attachment-hour plus per GB processed. Attachment fees accumulate across every connected VPC, making unused attachments a steady drain.
A hub that meters every spoke
Transit Gateway pricing scales with connectivity, not usage: each VPC, VPN, or Direct Connect attachment bills hourly for existing, and data processed through the gateway bills per GB on top. A hub with forty spoke VPCs runs forty simultaneous hourly meters. That makes the cost profile unusual: the gateway grows more expensive every time an account or VPC joins the network, whether or not the new spoke sends a single packet.
Metrics-backed attachment analysis
ZopNight discovers transit gateways on the 6-hour cycle and pulls hourly CloudWatch metrics from the TransitGateway namespace with a 90-day lookback, alongside per-resource cost from Cost Explorer or CUR 2.0. The lookback is what makes the unused-attachment recommendation trustworthy: an attachment with flat byte counters across 90 days is not “quiet this week”, it is disconnected in practice, and its hourly fee plus its spoke-side routing complexity are both recoverable. The gateway itself has no off switch, so findings resolve through detaching, not scheduling.
Spokes that stopped spoking
Attachment waste follows organizational churn. Sandbox and project VPCs get attached to the hub by default via account-vending automation, then sit dark. Teams migrate workloads into a consolidated VPC and the vacated VPC keeps its attachment because removing it needs a network-team ticket. VPN attachments to offices and datacenters persist after the site moved to Direct Connect or closed. Each is one hourly meter nobody is watching.
Surveying the hub in the VPC console
Transit gateways and their attachments live in the VPC console under their own views, showing per-attachment type, state, and owning account. The per-attachment CloudWatch byte metrics are the ground truth for utilization. Cross-account attachments deserve care: the attachment may look idle from the hub owner’s side while the spoke account still depends on it for rare but critical paths. Confirm with the owner before detaching.