Amazon VPC Peering: Design, Routing, Limitations, and Alternatives – SAP-C02 Study Guide

Purpose of This Lesson

Amazon VPC Peering provides private network connectivity between two Amazon VPCs. It is useful when workloads in separate VPCs need to communicate over private IP addresses without traversing the public internet.

The central design question is whether the environment needs a simple point-to-point connection or a scalable multi-VPC network. VPC Peering is straightforward for a small number of direct relationships, but its pairwise design becomes difficult to manage as the number of VPCs grows.

Key Concepts

What VPC Peering Provides

A VPC peering connection creates private connectivity between two VPCs using AWS infrastructure. Traffic remains on the AWS network rather than crossing the public internet.

VPC Peering can be used between:

• VPCs in the same AWS account
• VPCs in different AWS accounts
• VPCs in the same AWS Region
• VPCs in different AWS Regions using inter-Region VPC Peering

The VPCs must use non-overlapping CIDR blocks. For example, 10.0.0.0/16 and 10.1.0.0/16 can be peered, while two VPCs that both use 10.0.0.0/16 cannot be connected through normal VPC Peering.

Connection Establishment

VPC Peering uses a requester-and-accepter workflow:

1. The owner of one VPC creates a peering connection request.
2. The owner of the other VPC accepts the request.
3. Route tables in both VPCs are updated to send traffic through the peering connection.
4. Security controls, such as security groups and network ACLs, are configured to allow the required traffic.

Creating the peering connection alone does not provide end-to-end connectivity. Routing and security configuration are still required on both sides.

Routing Requirements

Each VPC must have a route pointing to the CIDR block of the other VPC, with the VPC peering connection as the target.

For example, if VPC A uses 10.0.0.0/16 and VPC B uses 10.1.0.0/16:

• A route in VPC A sends 10.1.0.0/16 to the peering connection.
• A route in VPC B sends 10.0.0.0/16 to the peering connection.

Routes are not propagated automatically between VPC route tables. The required routes must be explicitly added, either manually or through automation.

Security groups and network ACLs must also permit the traffic. Rules can reference the peer VPC’s CIDR range when appropriate.

No Transitive Routing

VPC Peering is not a transit service. If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot reach VPC C through VPC B unless a separate peering connection directly connects A and C.

This means VPC Peering supports direct connections only:

VPC A <----> VPC B <----> VPC C

A cannot reach C through B

A fully connected network of VPCs therefore requires a separate peering connection for every pair of VPCs.

Full-Mesh Connection Growth

For n VPCs, the number of required peering connections in a full mesh is:

n × (n - 1) ÷ 2

Examples:

• 2 VPCs: 1 connection
• 4 VPCs: 6 connections
• 8 VPCs: 28 connections

Each VPC also requires routes to the CIDR block of every other VPC. This creates an operational burden involving route tables, security rules, monitoring, and connection lifecycle management.

DNS Considerations

DNS resolution across a peering connection is not automatically enabled in every scenario. For inter-Region VPC Peering, DNS resolution must be configured explicitly using the relevant VPC peering DNS options.

When troubleshooting name resolution, verify both the VPC DNS settings and the peering connection DNS configuration. Network reachability and DNS resolution are separate concerns.

Exam-Relevant Takeaways

• VPC Peering is a private, direct connection between two VPCs.
• The peered VPC CIDR blocks cannot overlap.
• Cross-account and inter-Region peering are supported.
• Both VPCs require appropriate route table entries.
• Security groups and network ACLs still control traffic.
• VPC Peering does not provide transitive routing.
• A VPC cannot act as a routing hub for other peered VPCs.
• Full-mesh designs grow according to n × (n - 1) ÷ 2 and become difficult to operate.
• Transit Gateway is generally more appropriate for a larger, centrally managed multi-VPC network.
• VPN and Direct Connect are primarily choices for hybrid connectivity, not substitutes for ordinary inter-VPC connectivity.
• A peering connection can be active while traffic still fails because routes or security rules are missing.

Architecture Decision Guide

Requirement	Recommended approach	Reason
One VPC needs private access to another VPC	VPC Peering	Simple, direct point-to-point connectivity
A few VPCs need independent direct connections	VPC Peering	Acceptable when the topology remains easy to manage
Many VPCs require connectivity through a central network	AWS Transit Gateway	Provides scalable hub-and-spoke connectivity and transitive routing
VPCs have overlapping CIDR ranges	Redesign addressing or use an alternative architecture	Standard VPC Peering requires non-overlapping CIDRs
VPCs must connect to an on-premises data center	AWS Site-to-Site VPN or AWS Direct Connect	Designed for hybrid connectivity
Workloads in different Regions need private VPC connectivity	Inter-Region VPC Peering or Transit Gateway architecture	Selection depends on scale, routing model, and operational requirements

VPC Peering Versus Transit Gateway

Use VPC Peering when the relationship is direct and limited in scope. Use Transit Gateway when multiple VPCs need to communicate through a central routing layer or when the organization expects the network to expand.

Transit Gateway avoids the need to create a direct peering connection between every VPC pair. It is therefore better suited to centralized routing, shared network services, and large multi-account environments.

Common Exam Traps

Assuming a Peered VPC Is Automatically Reachable

The connection status must be active, but that is not enough. Add routes on both sides and permit the traffic in security groups and network ACLs.

Using a Peered VPC as a Router

A route from VPC A to VPC B does not allow VPC A to reach another VPC connected to B. Peering does not support transitive routing.

Ignoring CIDR Overlap

Overlapping CIDR blocks are a foundational design problem. Check all VPC address ranges before selecting VPC Peering.

Building a Large Full Mesh

A full mesh can appear simple with two or three VPCs but becomes increasingly complex as VPC count rises. Calculate the number of connections and route entries before selecting this design.

Confusing Private Connectivity with Authorization

VPC Peering supplies network reachability. It does not bypass security groups, network ACLs, application authentication, or service-level authorization.

Treating Peering as a Hybrid Connectivity Service

VPC Peering connects VPCs. AWS Site-to-Site VPN and Direct Connect address connectivity between AWS and external networks such as data centers.

Forgetting DNS Configuration

Successful IP connectivity does not guarantee that private hostnames resolve across the peering connection. Validate DNS settings separately, especially for inter-Region designs.

Real-World Engineer Notes

• Plan CIDR ranges across accounts, Regions, business units, and future acquisitions before deploying VPCs. Address overlap can constrain later connectivity choices.
• Automate peering creation, acceptance, route updates, and security changes with infrastructure-as-code or a controlled network-account workflow.
• Track the ownership and lifecycle of every peering connection. Cross-account connections often fail operationally because one team removes or changes a route without coordinating with the other team.
• Treat route tables as part of the connectivity contract. Document which destination CIDRs should be reachable through each peering connection.
• For larger environments, centralize routing with AWS Transit Gateway rather than allowing unmanaged peer-to-peer growth.
• Inter-Region connectivity may introduce additional latency and data transfer charges even though traffic uses private AWS networking. Include these factors in the architecture and cost review.
• Test return-path routing. A route in only one direction commonly causes asymmetric or one-way connectivity failures.

Quick Reference Summary

Topic	Summary
Connectivity type	Private VPC-to-VPC networking over AWS infrastructure
Addressing requirement	CIDR blocks must not overlap
Scope	Same account, cross-account, same Region, or inter-Region
Routing	Explicit routes are required in each participating VPC
Security	Security groups and network ACLs still apply
Transitivity	Not supported
Scaling model	Pairwise; full mesh requires n × (n - 1) ÷ 2 connections
Best use case	Simple one-to-one or small-scale VPC connectivity
Larger-scale alternative	AWS Transit Gateway
Hybrid alternative	AWS Site-to-Site VPN or AWS Direct Connect
DNS	Requires deliberate configuration; inter-Region DNS resolution is not automatic

Flashcards

1. What does Amazon VPC Peering provide?

Private, direct network connectivity between two VPCs using private IP addresses over AWS infrastructure.

1. What is the most important VPC Peering addressing requirement?

The VPC CIDR blocks must not overlap.

1. Can VPC Peering connect VPCs in different AWS accounts?

Yes. The request is created by one account and accepted by the other account.

1. Can VPC Peering connect VPCs in different Regions?

Yes, through inter-Region VPC Peering.

1. What must be configured after a peering connection is accepted?

Routes in the participating VPC route tables and appropriate security group and network ACL rules.

1. Does VPC Peering support transitive routing?

No. Every communicating VPC pair requires a direct peering connection.

1. Can VPC B serve as a routing hub between VPC A and VPC C?

No. VPC Peering is not a transit or hub-and-spoke service.

1. How many peering connections are required for a full mesh of four VPCs?

Six.

1. What formula calculates full-mesh peering connections?

n × (n - 1) ÷ 2.

1. Which AWS service is generally preferred for scalable multi-VPC routing?

AWS Transit Gateway.

1. Does accepting a peering request automatically update route tables?

No. Routes must be explicitly created or automated.

1. Does VPC Peering override security group rules?

No. Security groups and network ACLs continue to control traffic.

1. What should be checked when IP connectivity works but hostnames do not resolve?

VPC DNS settings and peering DNS configuration.

1. What service category is better suited to connecting AWS with an on-premises data center?

AWS Site-to-Site VPN or AWS Direct Connect.

Practice Questions

Question 1

A company has two VPCs in separate AWS accounts. The VPCs use 10.20.0.0/16 and 10.30.0.0/16. Applications in each VPC must communicate privately, and the network is expected to remain limited to these two VPCs. Which solution is most appropriate?

A. Internet Gateway with public IP addresses
B. VPC Peering
C. NAT Gateway in each VPC
D. AWS Direct Connect

Correct answer: B. VPC Peering

The VPCs have non-overlapping CIDRs and require a direct private connection. VPC Peering supports cross-account connectivity. Routes and security rules must still be configured in both VPCs.

Question 2

VPC A is peered with VPC B. VPC B is peered with VPC C. Routes exist from A to B and from B to C. Workloads in VPC A cannot connect to workloads in VPC C. What is the correct explanation?

A. VPC Peering does not support transitive routing.
B. VPC Peering requires an Internet Gateway.
C. VPCs cannot be peered across accounts.
D. NAT Gateway must be enabled in VPC B.

Correct answer: A. VPC Peering does not support transitive routing.

VPC A and VPC C require their own direct peering connection. A peered VPC cannot be used as a transit router for another peering connection.

Question 3

An organization has eight VPCs and wants every VPC to communicate directly with every other VPC. The network team is concerned about operational complexity. How many VPC peering connections would a full mesh require, and what is the better scalable alternative?

A. 8 connections; AWS Site-to-Site VPN
B. 16 connections; AWS Direct Connect
C. 28 connections; AWS Transit Gateway
D. 56 connections; NAT Gateway

Correct answer: C. 28 connections; AWS Transit Gateway

A full mesh requires 8 × 7 ÷ 2 = 28 connections. AWS Transit Gateway provides a more scalable centralized routing model and supports transitive connectivity.

Question 4

A peering connection between two VPCs is active, but an EC2 instance in VPC A cannot reach an instance in VPC B. Which troubleshooting sequence is most appropriate?

A. Replace the peering connection with an Internet Gateway.
B. Verify both route tables, security groups, network ACLs, and return-path routing.
C. Add a NAT Gateway to the destination VPC.
D. Enable public IPv4 addresses on both instances.

Correct answer: B. Verify both route tables, security groups, network ACLs, and return-path routing.

An active peering connection does not automatically create routes or permit traffic. Both directions require correct routing, and the security controls must allow the relevant protocol and ports.

Question 5

Two VPCs need to be connected, but both already use the CIDR block 10.0.0.0/16. Which statement is correct?

A. VPC Peering will translate one VPC’s addresses automatically.
B. VPC Peering can be enabled if the security groups allow the traffic.
C. The CIDR overlap is incompatible with standard VPC Peering and requires an addressing or architecture change.
D. A NAT Gateway resolves the overlap for private traffic.

Correct answer: C. The CIDR overlap is incompatible with standard VPC Peering and requires an addressing or architecture change.

VPC Peering requires non-overlapping CIDR blocks. The organization must redesign the address space or evaluate an alternative architecture that addresses the overlap requirement.