AWS VPC: VPN, Peering & Advanced Networking

VPC Peering

VPC peering connects two VPCs so resources can communicate using private IPs — no internet, no NAT, no VPN. Works across accounts and regions.

# Create peering connection (requester VPC)
aws ec2 create-vpc-peering-connection   --vpc-id vpc-0abc123   --peer-vpc-id vpc-0xyz789   --peer-owner-id 987654321012   --peer-region us-west-2   # omit for same region

# Accept peering request (accepter side)
aws ec2 accept-vpc-peering-connection   --vpc-peering-connection-id pcx-0abc123   --region us-west-2

# Add routes in BOTH VPCs (peering is NOT transitive)
aws ec2 create-route   --route-table-id rtb-vpc-a   --destination-cidr-block 10.1.0.0/16   --vpc-peering-connection-id pcx-0abc123

aws ec2 create-route   --route-table-id rtb-vpc-b   --destination-cidr-block 10.0.0.0/16   --vpc-peering-connection-id pcx-0abc123

# IMPORTANT: CIDRs must NOT overlap for peering to work
# Peering is NOT transitive: A↔B, B↔C does NOT mean A↔C

Transit Gateway

Transit Gateway is a hub-and-spoke network transit hub. Connect many VPCs, VPNs, and Direct Connect without N*(N-1)/2 peering connections.

# Create Transit Gateway
aws ec2 create-transit-gateway   --description "Central hub"   --options DefaultRouteTableAssociation=enable,DefaultRouteTablePropagation=enable

# Attach VPCs
aws ec2 create-transit-gateway-vpc-attachment   --transit-gateway-id tgw-0abc123   --vpc-id vpc-0abc123   --subnet-ids subnet-0a subnet-0b

# Add route in VPC route table → TGW
aws ec2 create-route   --route-table-id rtb-0abc123   --destination-cidr-block 10.0.0.0/8   --transit-gateway-id tgw-0abc123

Site-to-Site VPN

# 1. Create Customer Gateway (your on-premises VPN device)
aws ec2 create-customer-gateway   --bgp-asn 65000   --ip-address 203.0.113.5   --type ipsec.1

# 2. Create Virtual Private Gateway (attach to VPC)
aws ec2 create-vpn-gateway --type ipsec.1
aws ec2 attach-vpn-gateway   --vpn-gateway-id vgw-0abc123   --vpc-id vpc-0abc123

# 3. Create VPN connection
aws ec2 create-vpn-connection   --type ipsec.1   --customer-gateway-id cgw-0abc123   --vpn-gateway-id vgw-0abc123   --options StaticRoutesOnly=false  # use BGP

# 4. Download VPN config for your device
aws ec2 download-vpn-configuration   --vpn-connection-id vpn-0abc123   --output text

Key Design Decisions

• CIDR planning: choose non-overlapping ranges across all VPCs upfront — peering/TGW won't work with overlapping CIDRs.

• AZ spread: put subnets in at least 2 AZs. For critical services, use 3 AZs.

• VPC Endpoints: use for S3 and DynamoDB (Gateway endpoints = free); use Interface Endpoints for other services inside the VPC.

• NAT Gateway per AZ: place one NAT GW in each AZ to avoid cross-AZ data transfer charges and single point of failure.

• Private DNS: Route 53 Private Hosted Zones resolve internal service names within VPC.

• AWS PrivateLink: expose a service privately to other VPCs/accounts without VPC peering or internet exposure.

• Direct Connect: dedicated private fiber from on-premises to AWS — lower latency, consistent throughput, better for compliance than VPN.

• Security group best practice: create purpose-specific SGs (web-sg, app-sg, db-sg) and reference by ID, not CIDR.