AWS Compute - Peering Connections

VPC peering is non-transitive, means if vpc A advertises it's route to vpc B, it is exclusive. thus if there is a vpc C, and it request the info of vpc A route from vpc B, it is not possible to do so. (cause that's called a hub - all connected with vpc B as middle man).

so in order for all of them to be connected, they can try to do a fully meshed vpc peering like the pic below:

now this looks simple because it only involves 3 vpcs, what if it scales up? let's say 10 vpcs? how many peer networks need to be established?? the answer is using the formula: n x (n -1 /2). so for the case of 10 vpcs: 10 x (10-1/2) = 10 x 4.5 = 45. total of 45 networks need to be established! so if 100 vpcs, it would not be able to scale gracefully.

So there is one more solution called: Hub and Spoke but it has it's limitations such that only the hub can be connected to all spoke but the spokes cannot connect to other spokes. this is useful in business terms. See pic below and see if you can figure it out:

but let's say you're a company, and in your company, there are different departments, and they want to talk to each other, so you use CloudHub or Transit Gateway (or in early days, they call it route reflector that they use in IBGP to break the rules).

Difference between CloudHub and Transit Gateway is that CloudHub uses VPN (vpn is not private) but Transit Gateway uses private lines or combo of private line and VPN. both of these systems can break the rules of non-transitive peering. 

For Peer Connections using 1 account (by right must between 2 different accounts, but for example purpose, we will use 1 account only)

Step 1: Create 2 VPC myvpc-1 (11.0.0.0/16) and myvpc-2 (10.0.0.0/16) and its required components like subnet, Route Tables, IGW etc. (You can create VPC by using VPC with all its components option).

Step 2: Create an EC2 instance in each VPC and provide SG as all traffic and public IP addresses.

Step 3: Connect to any EC2 instance and try to ping the private IP address of other EC2 instances. You will not be able to ping because both instances are in different VPC.

Step 4: Select Peering connection using VPC left panel's options.

Step 5: Click on Create Peering connection

Step 6: Provide below configuration for your peering connection

• Name: myvpc-peer-to-yourvpc
• Requestor: Your VPC
• Acceptor: Other VPC, in real life, you will need their VPC ID and some other IDs

Step 7: Select Action and Click on Accept

Step 8: Update Route tables of each VPC by adding source as other VPC CIDR Range and connection type is peering connection.

Step 9: Now EC2 instances can ping to each other