What does it mean that VPC peering is non-transitive, and why does it matter?
Show the answer
Say this first
A peering connection only carries traffic between the two VPCs it joins. If A peers with B and B peers with C, A cannot reach C through B. A also cannot use B's internet gateway, NAT gateway, VPN, Direct Connect or gateway endpoint. Full connectivity between n VPCs needs n(n-1)/2 peerings, so beyond a handful of VPCs you move to a transit gateway.
Go deeper
Rules in AWS
- One-to-one, between two VPCs, same or different account, same or different region.
- CIDRs must not overlap.
- No edge-to-edge routing: traffic must start or end in one of the two peered VPCs.
- Both sides must add routes to the other VPC's CIDR with the
pcx-target, and security groups must allow the traffic. Peering by itself routes nothing. - In the same region, security groups can reference a group in the peer VPC.
- No hourly charge. Data across AZs or regions is charged as usual.
The scaling math
| VPCs | Peerings for full mesh |
|---|---|
| 5 | 10 |
| 10 | 45 |
| 50 | 1225 |
Each one also needs route entries on both sides. That is where a transit gateway wins.
Other clouds
- Azure VNet peering is non-transitive too. The exceptions are gateway transit (spokes use the hub's VPN or ExpressRoute gateway) and routing through a network virtual appliance with UDRs.
- GCP VPC Network Peering is non-transitive. It exchanges subnet routes, and custom routes only if you enable import and export.
They will ask next
When is peering still the right choice over a transit gateway?
For a few VPCs with heavy traffic between them. Peering has no per-GB processing charge and no hop, so two VPCs that move terabytes between them are cheaper and simpler peered directly.
VPC A peers with B, and B has a VPN to on-prem. Can A reach on-prem through it?
No. That is edge-to-edge routing and AWS drops it. Give A its own path, or connect all three to a transit gateway.
Traps
- Adding the route in one VPC only. Replies need a route back.
- Assuming a peer VPC can use your NAT gateway for internet access.