Pattern Comparison

Use this table to narrow down which pattern fits your scenario before reading the per-pattern walkthrough pages.

Comparison table

Pattern	OSI layer	CIDR overlap	Primary cost driver	Recommended use case
VPC Peering	L3	No	Same-region data transfer only; no hourly peering charge	Point-to-point private connectivity between two VPCs with non-overlapping CIDR blocks
PrivateLink	L4	Yes	Network Load Balancer, interface VPC endpoint hourly charges, and data processing fees	Exposing a single service to external consumers without sharing routes or CIDR space
VPC Lattice	L7	Yes	Service network, registered service, and data processing charges	Layer-7 service discovery, routing, and auth policies across VPCs and accounts
Transit Gateway	L3	No	Transit Gateway hourly charge, VPC attachment fees, and data processing	Hub-and-spoke routing across many VPCs and accounts from a central transit hub
Cloud WAN	L3	No	Core network, edge location, segment attachment, and multi-region data transfer	Global multi-region connectivity with segment-based isolation and centralized route policies

When to choose each pattern

VPC Peering

Tip

Choose VPC PeeringVPC Peering
L3 point-to-point connection between two VPCs. Requires non-overlapping CIDRs, acceptance, and optional DNS resolution enablement. when you need simple, low-cost L3 connectivity between exactly two VPCs in the same region, both VPCs have non-overlapping CIDRCIDR
Classless Inter-Domain Routing — IP range notation such as `10.10.0.0/16`. Peering and TGW need non-overlapping CIDRs; PrivateLink and Lattice do not. blocks, and you do not need a central routing hub or service-level abstraction.

PrivateLink

Tip

Choose PrivateLinkPrivateLink
AWS PrivateLink — L4 private connectivity via interface VPC endpoints to a provider endpoint service, without shared CIDR routing. when you want to publish a service to consumers in other accounts or VPCs that may have overlapping CIDR ranges, and you only need consumers to reach a specific endpoint — not full VPC-to-VPC routing.

VPC Lattice

Tip

Choose VPC LatticeVPC Lattice
AWS VPC Lattice — L7 service networking with service networks, discovery, routing, and auth policies shared across accounts via RAM. when you need Layer-7 routing, service discovery, and fine-grained auth policies across multiple VPCs and accounts, and consumers should connect to named services rather than IP addresses or CIDR ranges.

Transit Gateway

Tip

Choose Transit GatewayTransit Gateway
AWS Transit Gateway — regional L3 hub connecting many VPCs. Cross-account use needs RAM share, attachment acceptance, and routes. when you are building a hub-and-spoke network with many VPC attachmentsattachments
Connection of a VPC (or similar) to a TGW or Cloud WAN edge. Cross-account attachments often need acceptance and route setup. across accounts, need centralized route propagation, and all connected VPCs have non-overlapping CIDR blocks.

Cloud WAN

Tip

Choose Cloud WANCloud WAN
AWS Cloud WAN — managed global L3 network with multi-region edges and segment-based isolation policies. when you need global multi-region connectivity with segmentsegment
Logical Cloud WAN partition with its own route policy. This demo uses shared, workloads (mutual allow), and sandbox (isolated).-based traffic isolation (for example, allowing shared and workloads segments to communicate while keeping a sandbox segment isolated) and are willing to accept higher cost and operational complexity than regional patterns.

Quick selection guide

If you need…	Start with…
Simplest cross-account test	PrivateLink
Full VPC mesh at L3, two VPCs only	VPC Peering
L7 policies and service names	VPC Lattice
Many VPCs, one regional hub	Transit Gateway
Multi-region with segment isolation	Cloud WAN

All patterns use the same two accounts (123456789012 shared-services, 987654321098 dev) and deploy one at a time. See the Pattern Execution Model page for the recommended deploy-verify-teardown workflow.