Does it matter to have created a transit gateway attachment in public or private subnets?

Question

Does it matter if I had created my transit gateway attachment for VPC or Peering or even VPN in either public or private subnets? Are there any differences or scenarios that I need to take note of when creating them in either public or private subnets?

It seems like they still work in any of the subnets.

As a best practice, should the transit gateway attachments be created in public or private subnets?

Answer 1

"Does it matter to have created a transit gateway attachment in public or private subnets?"

Yes, it matters a lot where you create your VPC attachment ENIs (see below).

"As a best practice, should the transit gateway attachments be created in public or private subnets?"

The answer is: neither. For Transit Gateway the best practice is to put the resulting ENIs in dedicated connectivity subnets, for anything but very trivial routing requirements.

To know why you can watch NET331 from re:Invent 2018.
The short version is: it opens up a lot of possibilities to do neat routing tricks.

There is plenty of material on the subject (i.e., every re:Invent has several sessions on networking and TGW).