VPC Peering in AWS

What is a VPC?

A Virtual Private Cloud (VPC) in AWS is a customizable, isolated section of the AWS cloud where you can launch AWS resources like EC2 instances. It provides full control over the network environment, including IP address ranges, subnets, route tables, and gateways.

Introduction to VPC Peering

VPC Peering is a network connection between two VPCs in the AWS cloud, allowing them to communicate privately as if they were in the same network. The communication happens over private IP addresses without the need for a VPN or a separate gateway. This creates a direct network route between the two VPCs.

How VPC Peering Works

When two VPCs are peered, their routing tables are updated to allow instances in each VPC to communicate with each other. It's important to note that VPC peering connections are one-to-one, meaning each VPC pairing needs its own connection. VPC peering supports both intra-region (within the same AWS region) and inter-region (across different AWS regions) connections.

Key Features of VPC Peering

• High Availability: The connection is automatically provisioned across multiple AWS Availability Zones, providing high availability.
• Low Latency: VPC Peering uses the AWS global backbone infrastructure, ensuring low latency between VPCs.
• Security: Since the communication happens over AWS’s private infrastructure, it is secure without requiring additional encryption.
• Cost-Effective: There are no additional gateways or VPNs to set up, making it a cost-effective solution for connecting VPCs.

Limitations of VPC Peering

• No Transitive Peering: VPC peering is not transitive, meaning if VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate with VPC C.
• Manual Route Management: You must manually update route tables to facilitate traffic between peered VPCs.
• CIDR Overlap Restrictions: VPCs with overlapping CIDR blocks cannot be peered.

Use Cases of VPC Peering

• Multi-Account Architectures: Companies often use VPC peering to connect VPCs across different AWS accounts. This is useful for resource sharing, especially in large organizations with multiple teams working on different AWS accounts.
• Hybrid Cloud Architectures: If you have different workloads in separate VPCs (e.g., development in one and production in another), VPC peering allows these workloads to communicate seamlessly without leaving AWS.
• Data Replication: VPC Peering is ideal for services like database replication across VPCs. For example, you can set up a cross-region VPC peering to replicate data between two RDS instances in different regions for disaster recovery.

How to Set Up a VPC Peering Connection

1. Create Peering Request: From the AWS console, select your VPC, and create a peering connection request specifying the target VPC.
   

1. Accept the Peering Request: The owner of the target VPC must accept the request.
2. Update Route Tables: Both VPCs must have their route tables updated to allow communication.
3. Update Security Groups: Ensure security groups allow the necessary traffic from the peer VPC's CIDR block.

Sample Questions

Question 1:

Which of the following best describes VPC Peering in AWS?

A) A secure internet gateway connecting two VPCs.

B) A VPN connection allowing private communication between two VPCs.

C) A network connection that allows private communication between two VPCs over AWS's private infrastructure.

D) A direct connection from a VPC to an on-premises data center.

Answer: C
VPC Peering allows private communication between two VPCs over AWS’s private infrastructure without using a VPN or internet gateway.

Question 2:

Which of the following statements about VPC Peering is true?

A) VPC Peering allows transitive peering between multiple VPCs.

B) You can peer VPCs that have overlapping CIDR blocks.

C) VPC Peering can be established between VPCs in different AWS accounts.

D) You need to establish a separate VPC Peering connection for each Availability Zone.

Answer: C
VPC Peering can be established between VPCs in different AWS accounts, but it does not support transitive peering, and VPCs with overlapping CIDR blocks cannot be peered.

Question 3:

Which of the following is a cost factor associated with VPC Peering?

A) Data transfer charges between regions.

B) Monthly subscription fee for VPC Peering.

C) Cost of provisioning an internet gateway.

D) Increased EC2 instance costs due to VPC Peering.

Answer: A
While there’s no charge for creating a VPC Peering connection, AWS charges for data transfer between peered VPCs, particularly for inter-region traffic.

Question 4:

You are managing two VPCs (VPC A and VPC B) in the same AWS region. VPC A has a CIDR range of 10.0.0.0/16 and VPC B has a CIDR range of 192.168.0.0/16. Both VPCs have EC2 instances that need to communicate privately. You establish a VPC Peering connection and update the route tables, but the instances still cannot communicate. What could be the most likely cause of the issue?

A) The CIDR blocks overlap, preventing peering.

B) Security groups or Network ACLs are blocking the traffic.

C) A separate internet gateway needs to be provisioned.

D) VPC Peering connections require manual approval in each Availability Zone.

Answer: B
Even if the VPC Peering and route tables are correctly set up, the security groups or Network ACLs may still block the traffic. Ensure that the rules in both security groups and NACLs allow inbound and outbound traffic between the VPCs.

Question 5:

Your company operates VPCs in two different regions: VPC A in us-east-1 and VPC B in eu-west-1. You create a VPC Peering connection between them to allow instances in each region to communicate with each other. After setting up the peering connection and modifying the route tables, traffic is still not flowing between the instances. What additional step should be taken to resolve the issue?

A) Configure a VPN connection between the two VPCs.

B) Enable DNS resolution support for inter-region VPC Peering.

C) Ensure both VPCs are in the same Availability Zone.

D) Use an internet gateway to enable communication across regions.

Answer: B
For inter-region VPC Peering, DNS resolution must be enabled in the VPC settings to allow proper communication between instances using private IP addresses. This ensures smooth connectivity over private AWS infrastructure.