Why does security group referencing over Transit Gateway work between some of my VPCs but silently drop traffic between others?

Security group referencing across VPCs attached to the same Transit Gateway is supported now.

Two things explain the behavior you are seeing: how the feature is enabled, and a specific set of unsupported paths.

It is off by default, and there are two independent switches

• The Security Group Referencing Support option is disabled by default at the Transit Gateway level, including on transit gateways that were created before the feature existed. There is no additional cost to use it.

• Enable it at the TGW level in the console, or via the API/CLI:

  # On a new transit gateway
  aws ec2 create-transit-gateway \
      --description MyTransitGateway \
      --options SecurityGroupReferencingSupport=enable
  
  # On an existing transit gateway
  aws ec2 modify-transit-gateway \
      --transit-gateway-id tgw-1234abcd \
      --options SecurityGroupReferencingSupport=enable
  

• Changing the TGW-level setting does not change the setting on individual attachments. Each attachment keeps its own setting. If one VPC attachment still has it disabled, flows depending on referenced security groups into that VPC will fail while others succeed — which is exactly the "works for most, not all" symptom.

• When the feature is disabled (at either level), instance-to-instance traffic that relies solely on a referenced security group is dropped, unless another rule matches using an IPv4/IPv6 address or CIDR. This is why a VPC can stop passing traffic when the setting changes: keep equivalent CIDR-based rules in place while you migrate.