# AWS Transit Gateway

> AWS Transit Gateway bills per attachment-hour for every connected VPC and VPN, plus a per-GB charge on data processed through the hub. ZopNight discovers gateways on the 6-hour cycle, reads 90 days of CloudWatch TransitGateway metrics, attributes cost from Cost Explorer or CUR 2.0, and flags attachments passing no traffic.

Source: https://zop.dev/integrations/aws/transit-gateway
Updated: 2026-08-19

---

AWS Transit Gateway is a regional hub that interconnects VPCs and on-premises networks, billed per attachment-hour plus per GB processed. Attachment fees accumulate across every connected VPC, making unused attachments a steady drain.

## A hub that meters every spoke

Transit Gateway pricing scales with connectivity, not usage: each VPC, VPN, or Direct Connect attachment bills hourly for existing, and data processed through the gateway bills per GB on top. A hub with forty spoke VPCs runs forty simultaneous hourly meters. That makes the cost profile unusual: the gateway grows more expensive every time an account or VPC joins the network, whether or not the new spoke sends a single packet.

## Metrics-backed attachment analysis

ZopNight discovers transit gateways on the 6-hour cycle and pulls hourly CloudWatch metrics from the TransitGateway namespace with a 90-day lookback, alongside per-resource cost from Cost Explorer or CUR 2.0. The lookback is what makes the unused-attachment recommendation trustworthy: an attachment with flat byte counters across 90 days is not "quiet this week", it is disconnected in practice, and its hourly fee plus its spoke-side routing complexity are both recoverable. The gateway itself has no off switch, so findings resolve through detaching, not scheduling.

## Spokes that stopped spoking

Attachment waste follows organizational churn. Sandbox and project VPCs get attached to the hub by default via account-vending automation, then sit dark. Teams migrate workloads into a consolidated VPC and the vacated VPC keeps its attachment because removing it needs a network-team ticket. VPN attachments to offices and datacenters persist after the site moved to Direct Connect or closed. Each is one hourly meter nobody is watching.

## Surveying the hub in the VPC console

Transit gateways and their attachments live in the VPC console under their own views, showing per-attachment type, state, and owning account. The per-attachment CloudWatch byte metrics are the ground truth for utilization. Cross-account attachments deserve care: the attachment may look idle from the hub owner's side while the spoke account still depends on it for rare but critical paths. Confirm with the owner before detaching.