# VPC Peering — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-peering

> Set up a VPC peering connection, add routes on both sides and explain why peering is not transitive.

## A private link between exactly two VPCs

**VPC peering** connects two VPCs so that resources can talk using private IP addresses, as if they were on the same network. The two VPCs can be in different accounts and, in AWS, different regions. Traffic stays on the provider's backbone and never crosses the public internet. Setting it up has three steps: one side requests the peering and the other accepts it; each side adds a route for the other's CIDR pointing at the peering connection (`pcx-...`); and security groups on both sides allow the traffic. Two rules trip students up. First, the CIDR blocks **must not overlap**. Second, peering is **not transitive**: if A peers with B and B peers with C, A still cannot reach C through B. Nor can A use B's internet gateway, NAT gateway or VPN. Each pair that must talk needs its own peering, so a full mesh of n VPCs needs n(n-1)/2 connections, which becomes unmanageable quickly.

## Requesting, accepting and routing

Both route-table updates are needed, otherwise traffic flows one way and replies vanish.

```bash
PCX=$(aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-0aaaaaaaaaaaaaaaa --peer-vpc-id vpc-0bbbbbbbbbbbbbbbb \
  --query 'VpcPeeringConnection.VpcPeeringConnectionId' --output text)
aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id "$PCX"

# Route A -> B and B -> A
aws ec2 create-route --route-table-id rtb-0aaaaaaaaaaaaaaaa \
  --destination-cidr-block 10.20.0.0/16 --vpc-peering-connection-id "$PCX"
aws ec2 create-route --route-table-id rtb-0bbbbbbbbbbbbbbbb \
  --destination-cidr-block 10.10.0.0/16 --vpc-peering-connection-id "$PCX"
```

## A private footbridge between two buildings

A footbridge joins building A to building B. Someone in A can walk to B, but cannot continue to building C over B's separate footbridge; the rules say each bridge is only for its own two buildings.

**Quiz:** VPC A is peered with B, and B is peered with C. What is needed for A to reach C?

- [ ] Nothing; traffic passes through B automatically
- [ ] A route in B's table pointing to C
- [x] A direct A-C peering (or a transit hub) with routes on both sides
- [ ] An internet gateway in B

*Answer:* A direct A-C peering (or a transit hub) with routes on both sides. Peering is non-transitive. A needs its own connection to C, either a direct peering or a hub such as a transit gateway.