VPC peering concept in AWS - Step-by-Step Execution

Process Flow - VPC peering concept

Create VPC A

↓

Request Peering

→Accept Peering

↓

Peering Active

↓

Update Route Tables

↓

Traffic Allowed Between VPCs

Two VPCs are created separately. One requests peering, the other accepts. Once active, route tables are updated to allow traffic between them.

Execution Sample

AWS

1. Create VPC A and VPC B
2. VPC A sends peering request to VPC B
3. VPC B accepts peering request
4. Update route tables in both VPCs
5. Traffic flows between VPC A and VPC B

This sequence shows how two VPCs connect via peering to enable communication.

Process Table

Step	Action	State Change	Result
1	Create VPC A	VPC A exists	VPC A ready
2	Create VPC B	VPC B exists	VPC B ready
3	VPC A sends peering request	Peering request pending	Waiting for acceptance
4	VPC B accepts peering	Peering connection active	Peering established
5	Update route tables	Routes added to VPC A and B	Traffic allowed between VPCs
6	Test traffic flow	Packets sent between VPCs	Communication successful

💡 Peering active and routes updated, so traffic flows between VPCs

Status Tracker

Variable	Start	After Step 3	After Step 4	After Step 5	Final
VPC A	Not created	Exists	Exists	Exists	Exists
VPC B	Not created	Exists	Exists	Exists	Exists
Peering Connection	None	Pending	Active	Active	Active
Route Tables	No peering routes	No peering routes	No peering routes	Routes added	Routes added
Traffic Flow	Blocked	Blocked	Blocked	Allowed	Allowed

Key Moments - 3 Insights

Why can't VPCs communicate immediately after peering request is sent?

Because the peering connection is only pending (see step 3 in execution_table). It must be accepted (step 4) and routes updated (step 5) before traffic flows.

What happens if route tables are not updated after peering is active?

Traffic will still be blocked because route tables control network paths (see step 5 and 6). Updating routes is essential for communication.

Can VPC peering connect VPCs in different AWS accounts?

Yes, but the peering request and acceptance must be done across accounts. The flow remains the same as shown in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the peering connection become active?

A Step 4

B Step 5

C Step 3

D Step 6

💡 Hint

Check the 'State Change' column for when peering connection status changes to active.

According to variable_tracker, what is the state of 'Traffic Flow' after step 4?

A Allowed

B Blocked

C Pending

D Unknown

💡 Hint

Look at the 'Traffic Flow' row under 'After Step 4' column.

If route tables are not updated, what will be the result in step 6?

A Traffic allowed between VPCs

B Peering connection fails

C Traffic blocked despite active peering

D VPCs get deleted

💡 Hint

Refer to key_moments about route tables and execution_table step 5 and 6.

Concept Snapshot

VPC Peering connects two VPCs to enable private communication.
One VPC requests peering; the other accepts.
Peering becomes active after acceptance.
Route tables must be updated to allow traffic.
Traffic flows only after routes are set.
Peering works within or across AWS accounts.

Full Transcript

VPC peering allows two separate virtual networks (VPCs) to connect privately. First, both VPCs are created. Then, one VPC sends a peering request to the other. The second VPC must accept this request. Once accepted, the peering connection becomes active. However, to enable communication, route tables in both VPCs need to be updated to include routes pointing to the other VPC. Only after these updates can traffic flow between the VPCs. If route tables are not updated, even an active peering connection will not allow traffic. This process works for VPCs in the same or different AWS accounts.

Practice

1. What is the main purpose of VPC peering in AWS?

easy

A. To connect two private networks securely within AWS

B. To provide public internet access to a VPC

C. To create a backup of a VPC in another region

D. To launch virtual machines automatically

Solution

1. Step 1: Understand VPC peering concept

   VPC peering connects two private networks (VPCs) securely inside AWS without using the public internet.

2. Step 2: Compare options

   Only To connect two private networks securely within AWS describes secure connection of private networks. Other options describe unrelated AWS features.

3. Final Answer:

   To connect two private networks securely within AWS -> Option A

4. Quick Check:

   VPC peering = secure private network connection [OK]

Hint: VPC peering links private networks, not public access [OK]

Common Mistakes:

• Confusing VPC peering with internet gateway
• Thinking VPC peering creates backups
• Assuming it launches virtual machines

2. Which of the following is the correct way to create a VPC peering connection using AWS CLI?

easy

A. aws ec2 create-route-table --vpc-id vpc-123abc

B. aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def

C. aws ec2 create-subnet --vpc-id vpc-123abc --cidr-block 10.0.0.0/24

D. aws ec2 create-internet-gateway --vpc-id vpc-123abc

Solution

1. Step 1: Identify the correct AWS CLI command for VPC peering

   The command to create a VPC peering connection is create-vpc-peering-connection with source and peer VPC IDs.

2. Step 2: Check options

   aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def uses the correct command and parameters. Other options create unrelated resources like internet gateway, subnet, or route table.

3. Final Answer:

   aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def -> Option B

4. Quick Check:

   VPC peering CLI = create-vpc-peering-connection [OK]

Hint: Look for 'create-vpc-peering-connection' command [OK]

Common Mistakes:

• Using internet gateway or subnet commands instead
• Confusing route table creation with peering
• Missing peer VPC ID parameter

3. After establishing a VPC peering connection between VPC A and VPC B, which step is necessary to enable communication between instances in both VPCs?

medium

A. Attach a NAT gateway to both VPCs

B. Create an internet gateway in both VPCs

C. Enable public IP addresses on all instances

D. Update route tables in both VPCs to include routes to each other's CIDR blocks

Solution

1. Step 1: Understand VPC peering communication requirements

   VPC peering connects networks but does not automatically update routing. You must add routes to route tables for traffic to flow.

2. Step 2: Analyze options

   Only Update route tables in both VPCs to include routes to each other's CIDR blocks correctly describes updating route tables with routes to the peer VPC's CIDR block. Other options relate to internet or NAT, not peering.

3. Final Answer:

   Update route tables in both VPCs to include routes to each other's CIDR blocks -> Option D

4. Quick Check:

   Route tables must include peer CIDR for communication [OK]

Hint: Always update route tables after peering [OK]

Common Mistakes:

• Assuming internet gateway is needed for peering
• Thinking public IPs are required
• Confusing NAT gateway with peering setup

4. You created a VPC peering connection but instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

medium

A. Instances need public IP addresses to communicate over peering

B. The VPC peering connection is automatically rejected after creation

C. Route tables in VPC A or VPC B do not have routes to the peer VPC's CIDR block

D. Security groups do not allow internet traffic

Solution

1. Step 1: Check common VPC peering issues

   Communication fails often because route tables lack routes to the peer VPC's CIDR block.

2. Step 2: Evaluate other options

   The VPC peering connection is automatically rejected after creation is false; peering is not auto-rejected. Instances need public IP addresses to communicate over peering is wrong; public IPs are not needed. Security groups do not allow internet traffic is unrelated to peering communication.

3. Final Answer:

   Route tables in VPC A or VPC B do not have routes to the peer VPC's CIDR block -> Option C

4. Quick Check:

   Missing routes cause peering communication failure [OK]

Hint: Check route tables first when peering fails [OK]

Common Mistakes:

• Assuming peering rejects automatically
• Thinking public IPs are required for peering
• Confusing security group rules with internet traffic

5. You have two VPCs in different AWS regions and want to connect them using VPC peering. What is the correct approach?

hard

A. Create an inter-region VPC peering connection and update route tables accordingly

B. Create a standard VPC peering connection; region does not matter

C. Use an internet gateway to connect the two VPCs

D. Launch VPN instances in both VPCs and connect them manually

Solution

1. Step 1: Understand VPC peering across regions

   A special inter-region VPC peering connection is required to connect VPCs in different AWS regions.

2. Step 2: Analyze options

   Create an inter-region VPC peering connection and update route tables accordingly correctly states creating an inter-region peering and updating routes. Create a standard VPC peering connection; region does not matter is wrong because standard peering is regional. Use an internet gateway to connect the two VPCs and D describe unrelated or complex alternatives.

3. Final Answer:

   Create an inter-region VPC peering connection and update route tables accordingly -> Option A

4. Quick Check:

   Inter-region peering requires special connection and routing [OK]

Hint: Use inter-region peering for different AWS regions [OK]

Common Mistakes:

• Trying standard peering across regions
• Using internet gateway for private VPC connection
• Ignoring route table updates after peering