Jump into concepts and practice - no test required
or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
VPC Peering Concept
📖 Scenario: You are working as a cloud engineer for a company that has two separate Virtual Private Clouds (VPCs) in AWS. These VPCs need to communicate securely with each other without using the internet. To achieve this, you will set up a VPC peering connection between them.
🎯 Goal: Build a simple AWS VPC peering connection configuration using Terraform. You will create two VPCs, then configure a peering connection between them so they can communicate privately.
📋 What You'll Learn
Create two AWS VPCs with specific CIDR blocks
Create a VPC peering connection between the two VPCs
Add route table entries to allow traffic between the VPCs
Use Terraform syntax and best practices
💡 Why This Matters
🌍 Real World
Companies often have multiple VPCs for different teams or applications. VPC peering allows these VPCs to communicate securely without using the internet.
💼 Career
Cloud engineers and architects frequently set up VPC peering to enable private network communication between AWS environments.
Progress0 / 4 steps
1
Create two AWS VPCs
Create two AWS VPCs using Terraform. Name the first VPC vpc_a with CIDR block 10.0.0.0/16. Name the second VPC vpc_b with CIDR block 10.1.0.0/16. Use the resource type aws_vpc for both.
AWS
Hint
Use resource "aws_vpc" "vpc_a" and resource "aws_vpc" "vpc_b" blocks with cidr_block and tags.
2
Create a VPC peering connection
Create a VPC peering connection resource called vpc_peering between vpc_a and vpc_b. Use the resource type aws_vpc_peering_connection. Set vpc_id to aws_vpc.vpc_a.id and peer_vpc_id to aws_vpc.vpc_b.id. Add a tag with Name = "vpc_peering_connection".
AWS
Hint
Use resource "aws_vpc_peering_connection" "vpc_peering" with vpc_id and peer_vpc_id referencing the VPCs.
3
Add route tables for VPC A
Create a route table resource called rtb_a for vpc_a using aws_route_table. Add a route to rtb_a with destination CIDR block 10.1.0.0/16 that uses the VPC peering connection aws_vpc_peering_connection.vpc_peering.id. Use the resource aws_route named route_a_to_b.
AWS
Hint
Create aws_route_table for vpc_a and add a aws_route with the peering connection ID.
4
Add route tables for VPC B
Create a route table resource called rtb_b for vpc_b using aws_route_table. Add a route to rtb_b with destination CIDR block 10.0.0.0/16 that uses the VPC peering connection aws_vpc_peering_connection.vpc_peering.id. Use the resource aws_route named route_b_to_a.
AWS
Hint
Create aws_route_table for vpc_b and add a aws_route with the peering connection ID.
Practice
(1/5)
1. What is the main purpose of VPC peering in AWS?
easy
A. To connect two private networks securely within AWS
B. To provide public internet access to a VPC
C. To create a backup of a VPC in another region
D. To launch virtual machines automatically
Solution
Step 1: Understand VPC peering concept
VPC peering connects two private networks (VPCs) securely inside AWS without using the public internet.
Step 2: Compare options
Only To connect two private networks securely within AWS describes secure connection of private networks. Other options describe unrelated AWS features.
Final Answer:
To connect two private networks securely within AWS -> Option A
Hint: VPC peering links private networks, not public access [OK]
Common Mistakes:
Confusing VPC peering with internet gateway
Thinking VPC peering creates backups
Assuming it launches virtual machines
2. Which of the following is the correct way to create a VPC peering connection using AWS CLI?
easy
A. aws ec2 create-route-table --vpc-id vpc-123abc
B. aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def
C. aws ec2 create-subnet --vpc-id vpc-123abc --cidr-block 10.0.0.0/24
D. aws ec2 create-internet-gateway --vpc-id vpc-123abc
Solution
Step 1: Identify the correct AWS CLI command for VPC peering
The command to create a VPC peering connection is create-vpc-peering-connection with source and peer VPC IDs.
Step 2: Check options
aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def uses the correct command and parameters. Other options create unrelated resources like internet gateway, subnet, or route table.
Final Answer:
aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def -> Option B
Hint: Look for 'create-vpc-peering-connection' command [OK]
Common Mistakes:
Using internet gateway or subnet commands instead
Confusing route table creation with peering
Missing peer VPC ID parameter
3. After establishing a VPC peering connection between VPC A and VPC B, which step is necessary to enable communication between instances in both VPCs?
medium
A. Attach a NAT gateway to both VPCs
B. Create an internet gateway in both VPCs
C. Enable public IP addresses on all instances
D. Update route tables in both VPCs to include routes to each other's CIDR blocks
Solution
Step 1: Understand VPC peering communication requirements
VPC peering connects networks but does not automatically update routing. You must add routes to route tables for traffic to flow.
Step 2: Analyze options
Only Update route tables in both VPCs to include routes to each other's CIDR blocks correctly describes updating route tables with routes to the peer VPC's CIDR block. Other options relate to internet or NAT, not peering.
Final Answer:
Update route tables in both VPCs to include routes to each other's CIDR blocks -> Option D
Quick Check:
Route tables must include peer CIDR for communication [OK]
Hint: Always update route tables after peering [OK]
Common Mistakes:
Assuming internet gateway is needed for peering
Thinking public IPs are required
Confusing NAT gateway with peering setup
4. You created a VPC peering connection but instances in VPC A cannot reach instances in VPC B. What is the most likely cause?
medium
A. Instances need public IP addresses to communicate over peering
B. The VPC peering connection is automatically rejected after creation
C. Route tables in VPC A or VPC B do not have routes to the peer VPC's CIDR block
D. Security groups do not allow internet traffic
Solution
Step 1: Check common VPC peering issues
Communication fails often because route tables lack routes to the peer VPC's CIDR block.
Step 2: Evaluate other options
The VPC peering connection is automatically rejected after creation is false; peering is not auto-rejected. Instances need public IP addresses to communicate over peering is wrong; public IPs are not needed. Security groups do not allow internet traffic is unrelated to peering communication.
Final Answer:
Route tables in VPC A or VPC B do not have routes to the peer VPC's CIDR block -> Option C
Quick Check:
Missing routes cause peering communication failure [OK]
Hint: Check route tables first when peering fails [OK]
Common Mistakes:
Assuming peering rejects automatically
Thinking public IPs are required for peering
Confusing security group rules with internet traffic
5. You have two VPCs in different AWS regions and want to connect them using VPC peering. What is the correct approach?
hard
A. Create an inter-region VPC peering connection and update route tables accordingly
B. Create a standard VPC peering connection; region does not matter
C. Use an internet gateway to connect the two VPCs
D. Launch VPN instances in both VPCs and connect them manually
Solution
Step 1: Understand VPC peering across regions
A special inter-region VPC peering connection is required to connect VPCs in different AWS regions.
Step 2: Analyze options
Create an inter-region VPC peering connection and update route tables accordingly correctly states creating an inter-region peering and updating routes. Create a standard VPC peering connection; region does not matter is wrong because standard peering is regional. Use an internet gateway to connect the two VPCs and D describe unrelated or complex alternatives.
Final Answer:
Create an inter-region VPC peering connection and update route tables accordingly -> Option A
Quick Check:
Inter-region peering requires special connection and routing [OK]
Hint: Use inter-region peering for different AWS regions [OK]