Can I associate my AWS GovCloud (US) Transit Gateway with a Direct Connect Gateway in a different commercial account?

Resolution

Understanding the account-linking relationship

When you create an AWS GovCloud (US) account, AWS automatically creates a linked account in the standard (commercial) partition. This linked relationship enables sharing of certain AWS services between partitions, including AWS Direct Connect Gateway.

The AWS GovCloud (US) User Guide states:

"Direct Connect Gateway is supported between an AWS GovCloud (US) account and a linked standard/commercial AWS account."

Where the Direct Connect Gateway must reside

To associate a GovCloud Transit Gateway with a Direct Connect Gateway, the Direct Connect Gateway must be provisioned in the commercial account that is linked to your GovCloud account.

The Hybrid connectivity to AWS GovCloud (US) and commercial Regions using AWS Direct Connect blog states:

"The Transit VIF needs to be owned by the AWS commercial Region network account that is linked to the AWS GovCloud (US) network account since that is where the AWS Direct Connect gateway also needs to be provisioned."

When the Direct Connect Gateway is in the linked commercial account, it becomes visible from the GovCloud console as a "My account" resource, enabling direct association with your GovCloud Transit Gateway.

Cross-partition constraint

In the standard partition, cross-account association proposals allow you to associate a Transit Gateway with a Direct Connect Gateway owned by a different account. However, AWS GovCloud (US) Regions are physically isolated and have logical network isolation from all AWS Regions in other partitions. Cross-account association proposals do not traverse partition boundaries. Therefore, a GovCloud Transit Gateway cannot associate with a Direct Connect Gateway in a non-linked commercial account.

Summary

Scenario	Supported?
GovCloud TGW → DXGW in linked commercial account	Yes
GovCloud TGW → DXGW in a different commercial account	No — association proposals do not cross partition boundaries

Recommended architecture

If you need both GovCloud and commercial Transit Gateways to reach on-premises via Direct Connect:

1. Create the Direct Connect Gateway in the linked commercial account.
2. Associate your commercial Transit Gateways with the Direct Connect Gateway (same account or via cross-account proposals within the commercial partition).
3. From the GovCloud console, associate your GovCloud Transit Gateway with the same Direct Connect Gateway.
4. Create Transit Virtual Interfaces on your Direct Connect connections attached to this Direct Connect Gateway.

The same Direct Connect Gateway supports up to 6 Transit Gateway associations (Direct Connect Quotas), which can include both commercial and GovCloud Transit Gateways.

The April 2023 update to the AWS Public Sector Blog confirms:

"Customers can now use an additional transit virtual interface to provide logical network segmentation for GovCloud (US) and commercial Region communication across the same AWS Direct Connect."

If your Direct Connect Gateway is in a different commercial account

If the existing Direct Connect Gateway is not in your linked commercial account, you will need to create a separate Direct Connect Gateway in your linked commercial account and create additional Transit Virtual Interfaces on your existing Direct Connect connections to attach to it.

Relevant quotas

Resource	Limit	Adjustable
Transit Gateways per Direct Connect Gateway	6	No
Transit Virtual Interfaces per dedicated connection	4	Contact your TAM or Solutions Architect
Virtual Interfaces per Direct Connect Gateway	30	No

Source: Direct Connect Quotas

Related Information

• Hybrid connectivity to AWS GovCloud (US) and commercial Regions using AWS Direct Connect
• Direct Connect in AWS GovCloud (US)
• Direct Connect gateways and transit gateway associations
• Create a transit gateway association proposal
• Direct Connect Quotas