VPC Peering

Transitive peering limitations, non-overlapping CIDR requirement, inter-region peering, and routing table configuration.

Overview

Overview VPC Peering is an AWS networking feature that creates a direct, private network connection between two VPCs, enabling instances in either VPC to communicate as if they were on the same network. Traffic remains on the AWS backbone and never traverses the public internet, providing low latency and high bandwidth.

Peering connections can be established between VPCs in the same account, between different AWS accounts, or across AWS regions (inter-region VPC peering). The connection is established through a request-accept workflow: the requester VPC sends a peering request, and the accepter VPC owner approves it. Once active, both sides must update their route tables to direct traffic destined for the peer CIDR through the peering connection.

The most critical limitation of VPC peering is that it is non-transitive. If VPC A is peered with VPC B, and VPC B is peered with VPC C, traffic from VPC A cannot reach VPC C through VPC B. A separate peering connection between A and C is required. This fundamental constraint means that connecting N VPCs requires N*(N-1)/2 peering connections — a scaling problem that Transit Gateway was designed to solve.

VPC peering also requires non-overlapping CIDR blocks. VPCs with overlapping IP ranges cannot be peered, which makes CIDR planning a critical architectural consideration, especially for organizations that did not design CIDR spaces with future growth and connectivity in mind.

In production architectures, VPC peering is appropriate for small numbers of VPCs with specific connectivity needs (e.g., a shared services VPC peered with each application VPC), while Transit Gateway is preferred for hub-and-spoke architectures connecting many VPCs.

Key concepts

Non-Transitive Peering
VPC peering is strictly point-to-point. Traffic cannot flow through a VPC to reach another VPC via a chain of peering connections. If A-B and B-C are peered, A cannot reach C through B. This is by design for security isolation. The only workarounds are direct peering (A-C) or using Transit Gateway.
Non-Overlapping CIDR Requirement
Two VPCs cannot be peered if their IPv4 CIDR blocks overlap. AWS will reject the peering request. This requires careful IP address planning across accounts and regions. Many organizations use RFC 1918 space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) exhaustion plans to ensure unique CIDRs for every VPC.
Route Table Configuration
After accepting a peering connection, administrators must manually add routes in both VPCs' route tables. Each route specifies the peer VPC's CIDR as the destination and the peering connection ID as the target. Without these routes, traffic will not flow even though the peering is active.
Inter-Region Peering
VPC peering supports connections across AWS regions. Traffic is encrypted and uses AWS backbone infrastructure, not the public internet. Inter-region peering incurs data transfer charges (typically $0.01-0.02 per GB depending on regions). DNS resolution for private hostnames across regions requires specific DNS resolver configuration.
Security Group Cross-References
In VPC peering within the same region and account, security groups can reference the peer VPC's security group IDs as sources/destinations. This provides dynamic, identity-based access control rather than CIDR-based rules. Cross-account security group references require explicit sharing configuration.

When to use it

  • Connecting a small number of VPCs (fewer than 10) with specific bilateral connectivity needs
  • Providing access from application VPCs to a shared services VPC (DNS, monitoring, tooling)
  • Enabling cross-account access without exposing services to the internet
  • Low-cost option when Transit Gateway pricing is a concern for simple use cases
  • Inter-region data replication between VPCs in different AWS regions

Interview questions

  • What are the limitations of VPC peering and when would you use Transit Gateway instead?
  • Walk through the complete steps to establish a VPC peering connection between two accounts, including all configurations required for traffic to flow.

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio