VPC Peering and Transit Gateway

It is important to note that VPC peering does not require any additional physical hardware because it uses AWS’s existing infrastructure for connection, and therefore, no single point of failure or bandwidth bottleneck occurs in the communication.

VPC peering in AWS Regions

VPC peering allows to connect VPCs in the same and different AWS Regions.

• Intra-region connection: When configuring a VPC peering connection between VPCs within the same region, we can use security groups to allow traffic to and from the security group of the peering VPCs.

• Inter-region connection: If we connect the VPCs from different regions, we must use the CIDR address of the connecting VPC as the source or destination in the security group to control traffic. Resources use private IP addresses to communicate with each other and never use public IP addresses. Therefore, the data transferred over the network is encrypted.

VPC peering connection cost

There are no additional charges to use VPC peering connections. However, the data transfer charges are applied when data is transferred from one AZ to another AZ or AWS Region. Data transferred through VPC peering connections within the same AZ does not cost any charges. The illustration below shows the VPC peering between single and multiple AZs and AWS Regions.

Important pointers

The following points should be kept in mind when working with VPC peering: 

• VPC peering connection works on friendship principle. We can’t create a VPC peering connection from our VPC to any random VPC. The owner of the accepter VPC must accept the connection request.

• Once the connection is established, we must update the route tables and security groups (if required) of each VPC to allow the traffic to flow between them. 

• VPC peering between two VPCs is a one-to-one relationship, meaning a VPC can’t have multiple VPC peering connections with another VPC.

• VPC peering is not transitive peering; four VPCs in a region connected together to create a closed network doesn’t mean that the VPCs not connected directly can communicate with each other. In this case, we need a full mesh topology network.

• VPC peering doesn’t allow querying or connection to the Amazon DNS server.

• VPCs involved in a peering connection should not have overlapping IPv4 or IPv6 CIDR blocks.

• In inter-region VPC peering connections, a maximum of 1500 bytes of the transmission unit (MTU) is allowed. MTU more than 9001 (jumbo frames) are not supported.

Example: Connecting VPCs using VPC peering

There can be scenarios where we have resources provisioned in different VPCs in one AWS Region, different Regions, or even different AWS accounts. We might want to establish a secure connection between these VPCs to allow the resources to share data over private IPv4 or IPv6 addresses. 

Assume an organization has offices worldwide and its infrastructure is spread in different AWS Regions to facilitate the business. The resources deployed in each region are performing different tasks, and they might need to communicate with each other at some time to share data. The illustration below shows four VPCs from one AWS Region peered together with six peer connections.

VPC peering helped VPCs communicate and share information, but this is just a small demonstration of the network in an organization. Consider a network of 100 VPCs; then, the number of connections to create a full mesh peering will be [n(n-1)/2]. Managing this huge number of connections is a problem, and we need a solution. 

AWS Transit Gateway

AWS Transit Gateway is a regional resource used to connect thousands of VPCs and on-premises resources. It acts as a hub-and-spoke in the middle of the VPCs and routes traffic to them. It can manage connections to Direct Connect, Site-to-Site VPNs, and even a custom gateway. 

Example: Connecting VPCs using Transit Gateway

We discussed an issue related to increased network connections as the network grows. AWS Transit Gateway can be used in the above-discussed case study as a hub-and-spoke, and all the VPC peering connections will be replaced by one Transit Gateway. The diagram below shows the Transit Gateway that connects the VPCs.

Points to remember

Let’s go through some important points about the AWS Transit Gateway.

• Normally, a single instance of Transit Gateway is enough to manage all of your traffic in a region, but we can use more as required.

• AWS Transit Gateway can also peer VPCs across different AWS Regions.

• It is used to simplify the connections between the devices and resources within a network. 

• The VPCs connected to the Transit Gateway are peered.