VPN vs Transit Gateway cost: connecting networks at scale

Quick answer

Site-to-site VPN bills per connection-hour plus data transfer, simple and cheap for a few connections. Transit Gateway bills per attachment-hour (each connected VPC or VPN) plus a per-GB data processing charge, adding a processing cost but providing clean hub-and-spoke connectivity that scales to many networks without a mesh of peerings. For a handful of connections, VPN (or VPC peering) is cheaper; for many interconnected networks, Transit Gateway's manageability wins despite its data processing charge.

Connecting networks, VPCs to each other, or on-premises to cloud, has a few options with different cost shapes. Site-to-site VPN and Transit Gateway are common choices, and which is cheaper depends on how many networks you connect and whether you value simple scaling.

VPN vs Transit Gateway

	Site-to-site VPN	Transit Gateway
Billing	Per connection-hour + data	Per attachment-hour + data processing
Topology	Point-to-point	Hub-and-spoke (scales cleanly)
Best for	A few connections	Many interconnected networks

VPN bills per connection-hour plus data transfer, cheap and simple for connecting a few networks or on-premises sites. Transit Gateway bills per attachment (each VPC or VPN connected) per hour plus a per-GB data processing charge on traffic through it, adding cost but providing a central hub that connects many networks without a tangle of point-to-point links or VPC peerings.

Which is cheaper

For a handful of connections, VPN or VPC peering is cheaper, less overhead, no per-attachment or processing cost. As the number of interconnected networks grows, a full mesh of peerings or VPNs becomes unmanageable (N-squared connections), and Transit Gateway's hub-and-spoke model, though it adds attachment and processing charges, becomes worth it for the manageability and clean scaling. So the crossover is the number of networks and the complexity of a mesh.

Choosing for cost

Use VPN (or VPC peering) for a few connections where the simplicity and lower cost win. Move to Transit Gateway when you have many interconnected networks, where its hub-and-spoke connectivity avoids an unmanageable mesh and the per-attachment and processing cost is justified by the operational simplicity. Watch the Transit Gateway data processing charge (per GB through the hub) at high inter-network traffic, and reduce unnecessary cross-network traffic, part of overall network topology cost.

FAQ

Is VPN or Transit Gateway cheaper?

For a handful of connections, site-to-site VPN (or VPC peering) is cheaper, with less overhead and no per-attachment or data processing cost. For many interconnected networks, Transit Gateway's hub-and-spoke model wins despite its per-attachment-hour and per-GB processing charges, because it avoids an unmanageable mesh of point-to-point connections. The crossover is the number of networks.

How is Transit Gateway priced?

Per attachment-hour (each connected VPC or VPN) plus a per-GB data processing charge on traffic through it. So cost scales with how many networks you attach and how much traffic flows through the hub. The processing charge on inter-network traffic is a notable cost at high volume, on top of the per-attachment hourly fees.

When should I use Transit Gateway instead of VPN or peering?

When you have many interconnected networks where a full mesh of VPNs or VPC peerings becomes unmanageable (the number of connections grows with the square of the networks). Transit Gateway's hub-and-spoke model connects many networks through one central hub, and its per-attachment and processing cost is justified by the operational simplicity and clean scaling at that point.

How do I reduce Transit Gateway cost?

Watch the data processing charge (per GB through the hub) at high inter-network traffic and reduce unnecessary cross-network traffic, attach only the networks that need interconnection, and consider whether some connections could use cheaper VPC peering instead of routing through the gateway. The per-attachment hourly fees and processing charge are the main costs to manage.

Why does a mesh of connections become unmanageable?

Because connecting N networks point-to-point (via VPN or peering) requires on the order of N-squared connections to fully interconnect them, which grows quickly and becomes complex to manage and route. Transit Gateway replaces that mesh with a hub-and-spoke topology where each network attaches once to a central hub, scaling linearly and simplifying routing, which is why it wins at scale despite its cost.

Does C3X estimate VPN and Transit Gateway cost?

C3X prices both VPN connections and Transit Gateway attachments from your Terraform, including the hourly components, so the fixed cost of each option appears before deploy for comparison. The data and processing charges depend on traffic volume, which you provide as a usage assumption.

What to do next

Compare network connectivity options before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.